Reconcile pre-existing alembic autogenerate drift against models.py

`alembic check` on a freshly migrated slot DB (develop at 202610190400) reports ~60 drift operations the ORM and migrations disagree on. Examples: legacy columns still in the DB but unmapped (`nodes.skynet_home`, `nodes.autoupdate_desired`, `tasks.unattended`/`acceptance_bar`/`scope_fence`, `projects.has_repo`, `admin_users.name`, `identities.name`, `cloud_node_defaults.*`); indexes created in migrations but missing from the models (`uq_nodes_node_token_hash`, `ix_tasks_*`, the vector indexes); BIGINT vs Integer on several `project_id` columns; `org_id` composite FKs on the MFA/reset/trusted-device tables. Ask: for each item, either declare it in `app/models.py`, hide it deliberately in `migrations/env.py::include_object` with a reason, or drop it with an additive-safe contract migration. Then add an `alembic check`-style drift guard to the full gate so new drift fails CI. Out of scope: changing behaviour of any column or index; product features. Done means: - `alembic check` against a freshly migrated DB reports no operations. - The full gate runs a drift check and fails on new drift. - `./dc check full` is green.

Fixed lane failure: composite-keys selftest now compiles env.py's full hide-list block (NameError gone). Quick gate green; api suite green bar 1 pre-existing unrelated route-alias test. PR #5962 re-queued at 70d9896.