ensureSchema runs idempotent CREATE TABLE / ALTER TABLE (skipping
duplicate-column errors), cached once per isolate with retry on failure;
schema.sql becomes reference-only documentation
- messages: store ua/country alongside ip (audit only, not returned by GET);
full schema now documented in schema.sql
- submit: append IP/UA/country/time to PR body in a collapsed section;
never written into committed files