fix(db): chain users migration off c7d8e9f0a1b2; persist dev user on NO_LOGIN (OWASP#586)

Address review on OWASP#980:
- Drop obsolete merge revision f0e1d2c3b4a5; main already merges the two
  embedding heads via c7d8e9f0a1b2 (OWASP#979). Second merge left two Alembic heads.
- Point users migration at c7d8e9f0a1b2 and update the Revises docstring.
  Verified: flask db heads reports a single head; upgrade/downgrade/upgrade
  clean on Postgres.
- NO_LOGIN dev login now upserts the User and sets session['user_id'] when
  CRE_ENABLE_LOGIN is on, so local dev sessions have a row for user-scoped
  endpoints. Covered by tests for flag-on and flag-off.
- Narrow login persistence except from Exception to SQLAlchemyError.

Author: skypank-coder