Measure the schema bring-up, and record why it can't just be backgrounded

[Sbussiso]

Closes out finding F from review pass two — which flagged a real hazard and
then recommended the wrong fix. Having measured it, this records both.

The hazard is real

create_all() and sync_schema() run synchronously at module import. Nothing
is listening on the port while they run, Fly's grace_period for the app
group is 30s, and the single-machine immediate deploy strategy means
exceeding it fails the only machine with nothing serving.

But my recommended fix was wrong, twice

1. Relocating to lifespan changes nothing. uvicorn runs lifespan startup
before it binds the socket. Measured with a 6s artificial startup delay:

[ 0.03s] lifespan startup BEGIN (sleeping 6s)
   t≈2s  TCP: REFUSED   HTTP /health -> 000
[ 6.04s] lifespan startup END
          TCP: ACCEPTED  HTTP /health -> 200

Module import is earlier still, so both positions are equally invisible to a
health check. What actually makes sync_indexes safe isn't its location — it's
asyncio.create_task(asyncio.to_thread(...)), fire-and-forget, so startup
returns immediately and the port binds while indexes build.

2. Backgrounding these two isn't safe anyway. Indexes only make queries
faster, so building them late is invisible. These make queries possible:

call	backgrounded consequence
create_all	a fresh database serves its first request against missing tables
sync_schema	every query touching a newly added column errors until it lands

That trades a noisy deploy failure for a silent data-error storm.

So: visibility, which is the lever that exists

Both calls are timed and logged, with a WARNING above 10s of the 30s budget
that names the consequence — because "machine never became healthy" looks
nothing like "a migration got slow".

INFO  Schema bring-up 0.02s (create_all 0.00s, sync_schema 0.02s, changes: none)

WARN  Schema bring-up took 12.4s (...). Nothing is listening on the port until
      this finishes and Fly's health grace is 30s — a slower migration than
      this will fail the deploy rather than run late.

Both branches verified to fire (the WARNING by temporarily lowering the
threshold).

Verification

• 874 backend tests pass, ruff clean
• uvicorn bind ordering measured, not assumed

🤖 Generated with Claude Code