db(sensitiveNetworks): TAM-6886: add sensitive network schema and migrate existing sensitive facilities

[chris-bes]

Changes

Introduces the data model for sensitive networks, replacing the per-facility is_sensitive flag with network membership. This is schema and migration only — no sync behaviour changes yet (that lands with the sync lookup card).

• New sensitive_networks table (reference data, pulled from central), plus a nullable sensitive_network_id FK on facilities and a matching indexed column on sync_lookup. facilities.is_sensitive is dropped, with DDL/DML separated across migrations (create table → add columns → backfill → drop column).
• Backfill gives each existing sensitive facility its own network of one (not a shared network), preserving current isolation between previously-sensitive facilities exactly.
• Updates the non-sync readers of facility sensitivity (User.allowedFacilities on both server and mobile, the sync lookup filter helper, fake-data factories) to test sensitiveNetworkId instead of isSensitive.
• Matching TypeORM migrations and model registration on mobile so the reference data syncs down; mobile does not touch sync_lookup.
• Regenerated dbt source models under database/model/ for the new table/columns.

Spec: specs/sync/sensitive-networks.md. First of four cards for TAM-6886; nothing depends on it landing behaviourally yet.

Auto-Deploy

• Deploy

Options

• Artillery load test
• Seed from closest snapshot
• Generate fake data
• More data (20Gi)
• No facility servers (central-only)
• No sync (facility tasks scaled to zero)
• Skip mobile build
• Always build mobile
• Stay up for 8 hours
• Stay up for 24 hours
• Stay up (no TTL)
• Build images only (don't deploy)
• Build all images (amd64 + Windows; default is arm64 only)
• Pause this deploy

Tests

• Run E2E tests
• Run DAST scan

Review Hero

• Run Review Hero
• Auto-fix review suggestions Wait for Review Hero to finish, resolve any comments you disagree with or want to fix manually, then check this to auto-fix the rest.
• Auto-fix CI failures Check this to auto-fix lint errors, test failures, and other CI issues.
• Auto-merge upstream Check this to merge the base branch into this PR, with AI conflict resolution if needed.
• Save suppressions Check this to capture 👎 reactions on Review Hero comments as suppression rules in .github/review-hero/suppressions.yml. Also runs automatically at the end of any auto-fix run.

Remember to...

• ...write or update tests
• ...add UI screenshots and testing notes to the Linear issue
• ...add any manual upgrade steps to the Linear issue
• ...update the config reference, settings reference, or any relevant runbook(s)
• ...call out additions or changes to config files for the deployment team to take note of