chore(migrations): renumber 021-023 to 023-025 to clear the collision with main

main independently shipped 021_hashtag_counts_respect_bans and
022_client_upload_idempotency. sqlx::migrate! embeds ./migrations and refuses two
files per version, so these three had to move before the branch could merge at all.

Contents are untouched — only the version prefixes change. Renumbering (rather than
renumbering main's) is the safe direction: main is already deployed, so its 021 and
022 are applied in production and their versions are now immutable.

backend/migrations/025_reserved_names_and_pin_decay.down.sql

@@ -0,0 +1,11 @@
+-- NOTE: the reserved-name rename in the up migration is NOT reversible. The original names
+-- are not recorded anywhere, and reversing it would in any case re-create the state that
+-- bricked admin login. Rolling back the schema does not roll back that data change.
+DELETE FROM config WHERE key IN (
+    'recover_name_rate_per_15min',
+    'pin_reset_ip_rate_per_min',
+    'upload_edit_rate_per_min',
+    'upload_edit_rate_enabled'
+);
+
+ALTER TABLE "user" DROP COLUMN IF EXISTS last_failed_pin_at;