refactor(layout): 根目录脚本归位 src/ 与 scripts/，sql.d.ts 下沉到 db/

- bin.ts → src/bin.ts (生产入口归并到 src/，import 改用 #package + @/cli/*)
- compile.ts → scripts/compile.ts (开发期工具)
- embed-migrations.ts → scripts/embed-migrations.ts (codegen)
- src/sql.d.ts → src/server/db/sql.d.ts (与唯一消费者 migrations.gen.ts 共址)

效果：项目根从 3 个零散 .ts 减为 0 个，src/ 是完整应用源码，scripts/
明确区分开发期工具。所有 package.json scripts、AGENTS.md layout/CLI 章节、
compile.ts ENTRYPOINT 与 .js.map 清理路径同步更新。

验证：fix / typecheck / test 3/3 / build 570ms / compile 117M / docker
compose 全套（migrate 干净的 logger=cli.migrate JSON 日志、app /health
200、POST /api/todo/create 成功）。

src/bin.ts

@@ -0,0 +1,21 @@
+import { defineCommand, runMain } from 'citty'
+import { name, version } from '#package'
+
+// IMPORTANT: keep this file's static imports minimal. Nitro's bun preset
+// emits `.output/server/index.mjs` with a top-level `serve(...)` call, so any
+// eager (transitive) import of it would start the HTTP server even for
+// `migrate` or `--help`. All subcommands are lazy-loaded via citty.
+const main = defineCommand({
+  meta: {
+    name,
+    version,
+    description: 'Fullstack server binary (default subcommand: serve)',
+  },
+  default: 'serve',
+  subCommands: {
+    serve: () => import('@/cli/serve').then((m) => m.default),
+    migrate: () => import('@/cli/migrate').then((m) => m.default),
+  },
+})
+
+runMain(main)