Fix review findings; consolidate pre-release migrations

Bug fixes:
- Deleting a user with comments no longer 500s: remove the user's
  comments first (covers old DBs) and add ON DELETE CASCADE to the FK.
- Drop 'svg' from the default media upload allowlist (stored-XSS vector
  for files served directly from public/uploads/).
- Content index now reindexes on page deletion: track routable page
  count in content_index_meta and treat a count change as stale, since
  the newest-mtime check alone can't see a removal.
- Dev router (public/router.php) preserves the query string across the
  canonical trailing-slash redirect, matching .htaccess.
- Fix stale worked-example reference in the comments thread partial.

Migrations: since v2 is unreleased with no live databases, fold the
incremental ALTERs into the base migrations rather than shipping them
separately: verification columns into 0002_create_users.sql, source_count
into 0001_create_content_index.sql; renumber comments to 0003. Update all
code/doc references to the removed/renamed files.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

public/router.php

@@ -5,7 +5,11 @@
 $uri = urldecode(parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH));
 
 if ($uri !== '/' && str_ends_with($uri, '/')) {
-    header('Location: ' . rtrim($uri, '/'), true, 301);
+    // Preserve the query string across the canonical redirect — Apache's
+    // .htaccess does this automatically, so dev must too or post/redirect
+    // flows like /contact/?sent=1 lose their flags under `php -S`.
+    $query = parse_url($_SERVER['REQUEST_URI'], PHP_URL_QUERY);
+    header('Location: ' . rtrim($uri, '/') . ($query !== null ? '?' . $query : ''), true, 301);
     exit;
 }