storage: hoist the users column list into postgres/users.rs #1119

crates/nostream-storage/src/postgres/migration.rs carries its own USER_COLUMNS alongside a doc comment saying it is "find_by_pubkey's list plus tos_accepted_at". The seam reader and postgres/users.rs therefore describe users twice, which is the drift D1 exists to prevent: a column added to one and not the other reads as null in the migration and is caught by nothing.

Hoist the list into postgres/users.rs and have both use it, adding tos_accepted_at as the documented difference.

Why it was not done in the migration pass: the only tests that would catch a wrong column list are the #[ignore]d targets that need PARITY_ADMIN_URL and a live Postgres (tests/parity.rs, tests/migrations.rs). Moving a SQL literal without being able to run them verifies only that it compiles.

Acceptance: one definition of the column list, and the same row set before and after the hoist - the failure this guards against is a list that selects the same number of columns in a different order, so the count proves nothing and PARITY_ADMIN_URL being set proves nothing on its own. What proves it is the parity target's field-by-field comparison: cargo test -p nostream-storage --features postgres --test parity -- --ignored with PARITY_ADMIN_URL set, plus scripts/storage-parity.sh green.