refactor: 应用 Oracle round-4 复核，硬化 migrator 与默认安全值

- migrate: 校验已应用 migration 的 SHA-256，拒绝 schema drift；
  split 后 trim + skip empty，避免空 statement 触发 SQL 错误
- todo.contract: update 拒绝空 patch
- env: DATABASE_URL 限定 postgres(ql):// scheme，配置错误更早失败
- compile: autoloadDotenv: false，二进制部署不再吞 cwd 的 .env
- Error.tsx: 生产环境隐藏 error.message，避免内部错误泄露
- AGENTS: 同步 generatedFieldKeys / migrator 行为新描述

src/server/api/contracts/todo.contract.ts

@@ -8,7 +8,9 @@ const selectSchema = createSelectSchema(todoTable)
 
 const insertSchema = createInsertSchema(todoTable).omit(generatedFieldKeys)
 
-const updateSchema = createUpdateSchema(todoTable).omit(generatedFieldKeys)
+const updateSchema = createUpdateSchema(todoTable)
+  .omit(generatedFieldKeys)
+  .refine((data) => Object.keys(data).length > 0, { message: 'At least one field is required' })
 
 export const list = oc.input(z.void()).output(z.array(selectSchema))