Implement Phase 7: gRPC dual-stack interface

- proto/mcias/v1/: AdminService, AuthService, TokenService,
  AccountService, CredentialService; generated Go stubs in gen/
- internal/grpcserver: full handler implementations sharing all
  business logic (auth, token, db, crypto) with REST server;
  interceptor chain: logging -> auth (JWT alg-first + revocation) ->
  rate-limit (token bucket, 10 req/s, burst 10, per-IP)
- internal/config: optional grpc_addr field in [server] section
- cmd/mciassrv: dual-stack startup; gRPC/TLS listener on grpc_addr
  when configured; graceful shutdown of both servers in 15s window
- cmd/mciasgrpcctl: companion gRPC CLI mirroring mciasctl commands
  (health, pubkey, account, role, token, pgcreds) using TLS with
  optional custom CA cert
- internal/grpcserver/grpcserver_test.go: 20 tests via bufconn covering
  public RPCs, auth interceptor (no token, invalid, revoked -> 401),
  non-admin -> 403, Login/Logout/RenewToken/ValidateToken flows,
  AccountService CRUD, SetPGCreds/GetPGCreds AES-GCM round-trip,
  credential fields absent from all responses
Security:
  JWT validation path identical to REST: alg header checked before
  signature, alg:none rejected, revocation table checked after sig.
  Authorization metadata value never logged by any interceptor.
  Credential fields (PasswordHash, TOTPSecret*, PGPassword) absent from
  all proto response messages — enforced by proto design and confirmed
  by test TestCredentialFieldsAbsentFromAccountResponse.
  Login dummy-Argon2 timing guard preserves timing uniformity for
  unknown users (same as REST handleLogin).
  TLS required at listener level; cmd/mciassrv uses
  credentials.NewServerTLSFromFile; no h2c offered.
137 tests pass, zero race conditions (go test -race ./...)

cmd/mciasdb/schema.go

@@ -0,0 +1,63 @@
+package main
+
+import (
+	"fmt"
+
+	"git.wntrmute.dev/kyle/mcias/internal/db"
+)
+
+func (t *tool) runSchema(args []string) {
+	if len(args) == 0 {
+		fatalf("schema requires a subcommand: verify, migrate")
+	}
+	switch args[0] {
+	case "verify":
+		t.schemaVerify()
+	case "migrate":
+		t.schemaMigrate()
+	default:
+		fatalf("unknown schema subcommand %q", args[0])
+	}
+}
+
+// schemaVerify reports the current schema version and exits 1 if migrations
+// are pending, 0 if the database is up-to-date.
+func (t *tool) schemaVerify() {
+	version, err := db.SchemaVersion(t.db)
+	if err != nil {
+		fatalf("get schema version: %v", err)
+	}
+	latest := db.LatestSchemaVersion
+	fmt.Printf("schema version: %d (latest: %d)\n", version, latest)
+	if version < latest {
+		fmt.Printf("%d migration(s) pending\n", latest-version)
+		// Exit 1 to signal that migrations are needed (useful in scripts).
+		// We call os.Exit directly rather than fatalf to avoid printing "mciasdb: ".
+		fmt.Println("run 'mciasdb schema migrate' to apply pending migrations")
+		exitCode1()
+	}
+	fmt.Println("schema is up-to-date")
+}
+
+// schemaMigrate applies any pending migrations and reports each one.
+func (t *tool) schemaMigrate() {
+	before, err := db.SchemaVersion(t.db)
+	if err != nil {
+		fatalf("get schema version: %v", err)
+	}
+
+	if err := db.Migrate(t.db); err != nil {
+		fatalf("migrate: %v", err)
+	}
+
+	after, err := db.SchemaVersion(t.db)
+	if err != nil {
+		fatalf("get schema version after migrate: %v", err)
+	}
+
+	if before == after {
+		fmt.Println("no migrations needed; schema is already up-to-date")
+		return
+	}
+	fmt.Printf("migrated schema from version %d to %d\n", before, after)
+}