Keep the engine's state in SQLite, not Postgres

One process owns this database — the image has run a single uvicorn
worker for that reason since the four-engines bug — so a file beside the
flows is the honest shape for it, and it is what lets `fluksio serve`
need no infrastructure at all. Live values, node execution and the work
queue never came here anyway; what does is a rollup a minute at a time,
a row per cascade and the run history, and WAL keeps the readers going
while that one writer works.

DATA_DIR is now the one setting that moves everything an installation
keeps; the rest derive from it and the images still spell theirs out.
The schema is prepared in-process at startup, so the prestart service is
gone, and the ten Postgres-only revisions collapse into one portable
baseline.

Three things only worked because psycopg was casting for us: a token's
subject arriving as a string where the column is a UUID, `greatest`, and
`date_bin`. The timestamps needed a column type of their own — SQLite
stores no offset, and a naive datetime read back either raises against an
aware `now` or serialises as local time.

Postgres stays in the stack only for Umami, behind the analytics profile.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

backend/tests/flow/test_workers.py

@@ -123,7 +123,7 @@ def test_a_node_imports_the_standard_library_not_the_engines_own_modules(pool):
 
 def test_the_engines_secrets_are_not_in_a_workers_environment(pool, monkeypatch):
     monkeypatch.setenv("SECRET_KEY", "not-for-nodes")
-    monkeypatch.setenv("POSTGRES_PASSWORD", "not-for-nodes")
+    monkeypatch.setenv("DATABASE_URL", "not-for-nodes")
     monkeypatch.setenv("FLUKSIO_HARMLESS", "fine")
     # A fresh process, so it is built from the environment set just now.
     pool.respawn_all()
@@ -132,7 +132,7 @@ def test_the_engines_secrets_are_not_in_a_workers_environment(pool, monkeypatch)
         pool,
         "import os\n\n\n"
         "def process():\n"
-        "    return {'out': [k for k in ('SECRET_KEY', 'POSTGRES_PASSWORD',\n"
+        "    return {'out': [k for k in ('SECRET_KEY', 'DATABASE_URL',\n"
         "                                'FLUKSIO_HARMLESS') if k in os.environ]}\n",
     )
     assert result == {"out": ["FLUKSIO_HARMLESS"]}