Migrations

Schema, data-transfer, bulk-update, GDPR anonymisation, tenant clone, server move. Every destructive run requires 2-personen-approval.