Zero-downtime migrations for multi-tenant Postgres

Zero-downtime migrations rely on discipline more than heroics: expand first, deploy compatible code, backfill safely, then contract once old reads are gone. In multi-tenant Postgres, every migration also needs a batching strategy that respects the largest tenant in the system.