fix(web): crashes on Automation settings, /alerts and repeated Connect clicks - #2086

🟢 Confidence 8/10 · likely safe to merge. Held at 8 because a fix has not been re-checked against the whole diff yet.
_{no findings · tests covered · risk high −1 · 1 fix not yet re-checked against the whole diff}

The head strips hazel-oauth ids from every thresholds_json tier as well as the rule columns, and pins the whole migration with a PGlite fixture over mixed, hazel-only, untouched and malformed rows. Both earlier findings are addressed; safe to merge.

• Second alert_rules UPDATE removes retired ids from each severity tier's destinationIds, keeping tier order
• migrations.test.ts seeds four rules, two policies and delivery rows and asserts the surviving jsonb

Before merge

• Migration · Check it is safe on production data and with the code still deployed · packages/db/drizzle/20261101232654_drop_hazel_oauth_destinations/migration.sql
• Manual · Confirm no org still needs a hazel-oauth destination: the migration applies in the prd alchemy deploy and deletes those rows with nothing to restore them.

Fixed since the last review

• ✅ F1 · Migration cleans destination_ids_json but leaves the ids in thresholds_json tiers
• ✅ F2 · The new data migration has no PGlite test

Production impact

_{e00f6da · Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}