Restore the applied migrations byte for byte (#417)

ddiff --git a/migrations/0001_bot.sql b/migrations/0001_bot.sql
iindex 0ad9a08..1df669b 100644
---- a/migrations/0001_bot.sql
++++ b/migrations/0001_bot.sql
@@@ -25,9 +25,9 @@ CREATE TABLE robots (
      profile_version integer NOT NULL DEFAULT 1,
      access_policy   text NOT NULL DEFAULT 'private' CHECK (access_policy IN ('private', 'invite', 'queue')),
      limits          jsonb NOT NULL DEFAULT '{}',         -- owner-set: max_speed, max_turn, max_command_ms, turn_ms, turn_budget, cooldown_ms, allow
--    estop_latched   boolean NOT NULL DEFAULT false,   -- legacy stop latch, no longer read or written; contract-migration later
--    estop_by        text,                                -- legacy: who latched it; unused
--    estop_at        timestamptz,                        -- legacy; unused
++    estop_latched   boolean NOT NULL DEFAULT false,
++    estop_by        text,                                -- the principal that latched it, or 'device'
++    estop_at        timestamptz,
      created_at      timestamptz NOT NULL,
      updated_at      timestamptz NOT NULL
  );
@@@ -94,7 +94,7 @@ CREATE TABLE command_audit (
      operator_subject text,                               -- the person, or the subject a service acted for
      operator_kind    text,                               -- user | service
      role             text,                               -- owner | operator | viewer | null
--    kind             text,                               -- drive | actuator | ptz | say | display | halt
++    kind             text,                               -- drive | actuator | ptz | say | display | halt | estop
      value            jsonb NOT NULL DEFAULT '{}',        -- a small summary (clamped axes, servo, text length), never a credential
      result           text NOT NULL CHECK (result IN ('ack', 'nack', 'refused', 'expired')),
      reason           text,
ddiff --git a/migrations/0012_robot_agent_control.sql b/migrations/0012_robot_agent_control.sql
iindex 3f5a596..dfc37b2 100644
---- a/migrations/0012_robot_agent_control.sql
++++ b/migrations/0012_robot_agent_control.sql
@@@ -2,7 +2,7 @@
  --
  -- The owner's agent (plan T15 "an Actor agent can pilot a robot under the owner's grant", always through Bot): with
  -- agent_control on, the owner's OpenVibe.Actor agent may send this robot commands as the owner (Actor's service token,
---- grant bot.robot.control, X-OV-Subject = the owner). Bot's gate and limits still decide every command; the
++-- grant bot.robot.control, X-OV-Subject = the owner). Bot's gate, limits and e-stop still decide every command; the
  -- device's deadman still stops it. Off for every robot until its owner turns it on. Additive only.
  
  ALTER TABLE robots ADD COLUMN agent_control boolean NOT NULL DEFAULT false;
ddiff --git a/migrations/0036_looi_operators.sql b/migrations/0036_looi_operators.sql
iindex 59239f7..068cdec 100644
---- a/migrations/0036_looi_operators.sql
++++ b/migrations/0036_looi_operators.sql
@@@ -1,8 +1,8 @@
  -- phase: expand
  -- LOOI Operators card (Maticus's 2026-11-12 spec): a Mod role between the owner and operators, a per-person
  -- on/off switch that the command gate reads before it forwards anything, sole control for one subject, and an
---- audit of who changed authority. A Stop is now one ordinary control (a halt command), not a latch; the old
---- robots.estop_* columns are left for a later contract migration and are no longer read or written.
++-- audit of who changed authority. Panel E-STOP stays the robots.estop_latched latch; the tray's local STOP and
++-- ARM are never touched by this table.
  ALTER TABLE robot_operators DROP CONSTRAINT IF EXISTS robot_operators_role_check;
  ALTER TABLE robot_operators ADD CONSTRAINT robot_operators_role_check CHECK (role IN ('owner', 'operator', 'viewer', 'mod'));
  ALTER TABLE robot_operators ADD COLUMN IF NOT EXISTS enabled boolean NOT NULL DEFAULT true;
@@@ -17,7 +17,7 @@ CREATE TABLE IF NOT EXISTS robot_operator_control (
  );
  
  -- Authority changes: who granted sole control, switched someone on or off, promoted or demoted a Mod, or
---- granted or cleared sole control. Subjects and roles only: no command values, tokens or secrets.
++-- tripped/cleared the panel E-STOP. Subjects and roles only: no command values, tokens or secrets.
  CREATE TABLE IF NOT EXISTS robot_operator_audit (
      id            bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
      robot_id      text NOT NULL,