refactor(migration): delete pkg/migrator, move SQL to per-plugin embed

BREAKING: pkg/migrator/ deleted entirely. Migration SQL files are now
owned by each plugin in its own migrations/ directory.

Architecture:
- Delete pkg/migrator/ (26 global SQL files + ClickHouse migration)
- Move global SQL to per-plugin migrations/ with go:embed + Register()
- Rewrite cmd/app.go gooseEngine: uses Inject[DBService] for DB, iterates
  all plugin-registered MigrationEntry, runs goose.Up per entry
- core.MigrationEngine.Migrate signature changed: *Context instead of
  context.Context, so engine can resolve services via IoC

Per-plugin migration ownership:
  auth/             → w_access_tokens, w_auth_sources, w_external_accounts
  user/             → w_users (seed system user)
  admin/            → w_system_configs, w_templates (seeds)
  upload/           → w_uploads, w_upload_stats
  message_gateway/  → w_push_*, w_message_*
  risk_control/     → w_user_access_logs (PG + ClickHouse)
  driver_asynq_cron/  → w_schedules
  driver_asynq_worker/ → w_task_executions

Dependencies:
- cmd/banner.go: removed migration report display (migrations are automatic)
- cmd/reset_passwd.go: removed PreRun migrator.Migrate() call
- go.mod: clickhouse-go kept (used by plugins/infra/database/clickhouse.go)

cmd/app.go

@@ -4,12 +4,13 @@
 package cmd
 
 import (
-	"context"
+	"fmt"
+	"log"
 	"time"
 
 	"github.com/Rain-kl/Wavelet/core"
+	"github.com/Rain-kl/Wavelet/core/contracts"
 	"github.com/Rain-kl/Wavelet/pkg/config"
-	"github.com/Rain-kl/Wavelet/pkg/migrator"
 	"github.com/Rain-kl/Wavelet/plugins/domain/admin"
 	"github.com/Rain-kl/Wavelet/plugins/domain/auth"
 	"github.com/Rain-kl/Wavelet/plugins/domain/cap"
@@ -25,6 +26,7 @@ import (
 	"github.com/Rain-kl/Wavelet/plugins/infra/database"
 	"github.com/Rain-kl/Wavelet/plugins/infra/logger"
 	"github.com/Rain-kl/Wavelet/plugins/infra/storage"
+	"github.com/pressly/goose/v3"
 )
 
 // newWaveletApp creates a core.App wired with Wavelet platform infrastructure, domain plugins, and profile drivers.
@@ -56,7 +58,7 @@ func newWaveletApp(profile core.Profile) *core.App {
 		system.New(),
 	)
 
-	// 3. Bind Goose migration engine (wraps pkg/migrator.Migrate)
+	// 3. Bind Goose migration engine
 	app.SetMigrationEngine(&gooseEngine{})
 
 	// 4. Mount runtime drivers for each aspect
@@ -69,11 +71,65 @@ func newWaveletApp(profile core.Profile) *core.App {
 	return app
 }
 
-// gooseEngine implements core.MigrationEngine by wrapping pkg/migrator.Migrate.
-// It runs all centrally managed Goose SQL migrations during app startup.
+// gooseEngine implements core.MigrationEngine by iterating all plugin-registered
+// migration entries and applying each plugin's migrations against the shared DB.
+//
+// Each plugin owns its own `migrations/*.sql` directory, embedded via go:embed
+// and registered via ctx.Migrations().Register(pluginID, embedFS). The engine
+// resolves DBService from the IoC container and runs every entry in order.
 type gooseEngine struct{}
 
-func (e *gooseEngine) Migrate(_ context.Context, _ []core.MigrationEntry) error {
-	_ = migrator.Migrate()
+func (e *gooseEngine) Migrate(ctx *core.Context, entries []core.MigrationEntry) error {
+	if len(entries) == 0 {
+		return nil
+	}
+
+	// Resolve DBService from the IoC container.
+	var dbSvc contracts.DBService
+	if err := core.Using[contracts.DBService](ctx, func(svc contracts.DBService) {
+		dbSvc = svc
+	}); err != nil {
+		return fmt.Errorf("migration: resolve DBService: %w", err)
+	}
+
+	gormDB := dbSvc.GORM()
+	if gormDB == nil {
+		return fmt.Errorf("migration: DBService.GORM() returned nil")
+	}
+
+	sqlDB, err := gormDB.DB()
+	if err != nil {
+		return fmt.Errorf("migration: get underlying %s from GORM: %w", dialectName(), err)
+	}
+
+	dialect := dialectName()
+	for _, entry := range entries {
+		log.Printf("[migrate] applying %s migrations (%s)", entry.PluginID, entry.Dir)
+
+		goose.SetBaseFS(entry.FS)
+		if err := goose.SetDialect(dialect); err != nil {
+			return fmt.Errorf("migration %s: set dialect %q: %w", entry.PluginID, dialect, err)
+		}
+
+		dir := entry.Dir
+		if dir == "" {
+			dir = "migrations"
+		}
+
+		if err := goose.Up(sqlDB, dir); err != nil {
+			return fmt.Errorf("migration %s: apply %w", entry.PluginID, err)
+		}
+
+		log.Printf("[migrate] %s migrations applied", entry.PluginID)
+	}
+
 	return nil
 }
+
+// dialectName returns the goose dialect based on the configured database engine.
+func dialectName() string {
+	if !config.Config.Database.Enabled {
+		return "sqlite3"
+	}
+	return "postgres"
+}