fix: address PR #1641 review comments (round 3)

- Fix migration version conflict: addSessionPlatformSourceColumn now uses v25
- Sanitize observation titles in file-context deny reason (strip newlines, limit length)
- Guard json_each() with LIKE '[%' check for legacy bare-path rows
- Guard /stream SSE endpoint with 503 before DB initialization
- Scope bun-runner signal exit handling to start subcommand only
- Normalize platformSource at route boundary in DataRoutes

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

plugin/scripts/bun-runner.js

@@ -196,7 +196,7 @@ child.on('close', (code, signal) => {
   // Fix #1505: When the "start" subcommand forks a daemon, the parent bun
   // process may be killed by signal (e.g. SIGKILL, exit code 137). The daemon
   // is running fine — treat signal-based exits for "start" as success.
-  if (signal || (code > 128 && args.includes('start'))) {
+  if ((signal || code > 128) && args.includes('start')) {
     process.exit(0);
   }
   process.exit(code || 0);