fix(db): keep SQLite temp files in memory so trips can be deleted (#2518)

Deleting a trip failed with SQLITE_IOERR_GETTEMPPATH when the container
runs with a read-only root filesystem and no tmpfs on /tmp. The cascade
behind DELETE FROM trips keeps a statement journal, SQLite moves it to a
temp file once it passes 64 KiB, and it looks for a directory for that
file in SQLITE_TMPDIR, TMPDIR, /var/tmp, /usr/tmp, /tmp and the working
directory. None of them is writable there. Installs on the shipped
compose file have a tmpfs on /tmp and never hit it.

Every connection the server opens now comes from openDatabase() in
src/db/connection.ts, which sets temp_store = MEMORY: the main database
(also when it is reopened after a restore), each plugin's own database
and the uploaded backup checked before a restore. reset-admin.js and the
key rotation script cannot import src/ in the image, so they set the
pragma themselves. A test pins that nothing else in src/ constructs a
handle, and one deletes a full trip on the real schema and watches for
temp files.

server/scripts/migrate-encryption.ts

@@ -184,6 +184,10 @@ async function main() {
 
   const db = new Database(dbPath);
   db.pragma('busy_timeout = 5000');
+  // Temp files in memory, like every connection src/db/connection.ts opens: a
+  // container with a read-only root and no tmpfs on /tmp has nowhere to put
+  // them, and the rotation below runs as one long transaction (#2518).
+  db.pragma('temp_store = MEMORY');
 
   // The rollback copy has to be a consistent snapshot, not a plain file copy:
   // this script is documented as running against a live server, so in WAL mode