fix: address review findings - startup wiring, singleton version table, version guards

- __init__.py now calls apply_migrations() on setup instead of raw DDL
  (HIGH finding: the runner was never invoked at startup); lifecycle
  wiring tests in test_migrations.py cover fresh migrate, reload reuse,
  and close-on-failure
- VERSION_TABLE DDL enforces singleton row (id=1 PRIMARY KEY + CHECK)
  and version >= 1; stamp is INSERT .. ON CONFLICT DO UPDATE keyed on
  the singleton row
- read_schema_version rejects non-integer and sub-1 versions with
  explicit guards (bool excluded)
- no-op test asserts content hash + mtime, not just size

custom_components/nestquest/__init__.py

@@ -11,7 +11,7 @@ from homeassistant.core import HomeAssistant
 
 from .const import DOMAIN, LOGGER
 from .db import NestQuestDatabase
-from .schema import SCHEMA_V1_STATEMENTS, async_apply_ddl
+from .migrations import apply_migrations
 from .store import async_get_db_path
 
 _LOGGER = LOGGER
@@ -52,7 +52,7 @@ async def async_setup_entry(hass: HomeAssistant, entry: ConfigEntry) -> bool:
 
     database = await NestQuestDatabase(hass).open(await async_get_db_path(hass))
     try:
-        await async_apply_ddl(database, SCHEMA_V1_STATEMENTS)
+        await apply_migrations(database)
         remove_update_listener = entry.add_update_listener(_async_update_listener)
     except BaseException:
         await database.close()