feat(store): shared, video-keyed transcript persistence (ADR-021)

Reshape the dead per-user transcripts table (PK videos.id, user_id,
RLS-FORCEd — never read or written by app code) into the shared public
caption store ADR-021 specifies: keyed by (provider, provider_video_id),
no user_id, NOT RLS-scoped. Migration 015 (reversible). Add
ports.TranscriptStore + Store.GetTranscript/SaveTranscript via the raw
pool (no withUser): public content, shared across users by construction.
SaveTranscript persists only terminal outcomes (captions/none) and
refuses SourceRateLimited so a transient 429 can never be stored as a
false permanent absence (ADR-014).

Flip the isolation proof: transcripts leaves the RLS-scoped set;
TestTranscriptsTableIsSharedNotRLS asserts it is the SINGLE non-RLS
surface (writable/readable with no user scope, no user_id column, RLS off
on it alone, still on every user-owned table) — the proof the
public-content classification was applied exactly here and leaked nowhere.
appPool made idempotent so two tests can build it. Adjust the 010/011/014
up-down migration tests for the new HEAD. account.go: user deletion no
longer strips shared transcripts. Reconcile data-model.md + CLAUDE.md.

Wiring the engine to read-stored-first is the next commit.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -46,8 +46,9 @@ These caused real mistakes that were caught and corrected; the corrections are l
 (See `DECISIONS.md` for full rationale. Listed here so you don't propose them.)
 
 - **No Supabase** — reuse Dex / ESO+1Password / Postgres (ADR-002).
-- **No global cross-tenant video/transcript table** — per-user isolation (data-model). Dedup
-  across users is a Future C concern, not a Stage 0/1 default.
+- **No global cross-tenant *video* table** — videos stay per-user (data-model). Transcripts ARE
+  shared since ADR-021 (public caption content, keyed by `(provider, provider_video_id)`, non-RLS)
+  so re-analysis never re-fetches; the *videos* half of cross-tenant dedup stays a Future C concern.
 - **No audio-download + speech-to-text in the core path** — captions-first (ADR-007). STT is a
   deferred, bounded optional component.
 - **No public SaaS / sign-up / billing / Google OAuth verification at scale** — Future C,