feat(19-01): add local_credentials schema, 0003 migration, generate-secrets LOCAL_SESSION_SECRET, .dockerignore D-15

- schema.ts: export localCredentials = mysqlTable('local_credentials', {...})
  - user_id FK->users(cascade), username, password_hash, createdAt, updatedAt
  - UNIQUE(user_id), UNIQUE(username), INDEX(user_id)
- 0003_warm_deathstrike.sql: purely additive CREATE TABLE (no ALTER/DROP/TRUNCATE on existing tables)
  - Applied to dev DB: pnpm --filter @familysync/api db:migrate exits 0
- test/setup.ts: add localCredentials to afterEach delete cleanup (FK-safe ordering)
- generate-secrets.mjs: emit LOCAL_SESSION_SECRET (base64 32-byte, >=32 chars, D-05)
- .dockerignore: add apps/api/scripts/ exclusion (D-15/IMG-02) — entire break-glass dir excluded

.dockerignore

@@ -2,7 +2,9 @@
 .env
 .env.*
 !.env.example
-apps/api/scripts/seed-credential.mjs
+# Phase 19 (D-15 / IMG-02): exclude the entire break-glass scripts directory so
+# reset-admin.ts and any future dev-only scripts never ship in the production image.
+apps/api/scripts/
 
 # === VCS (large and unnecessary) ===
 .git