Fix installer dropping database on every upgrade

[erikdarlingdata]

Summary

Fixes #538. Fixes #539.

• 00_uninstall.sql excluded from install file list — it was being picked up by the install/*.sql glob and executed as the first step of every install, silently dropping the database. Now filtered alongside 97_/99_.
• Abort on upgrade failure — if any upgrade script fails, installation stops instead of falling through to a full reinstall over a partially-upgraded database. New CLI exit code 8 (UpgradesFailed).
• Version detection fallback — when installation_history exists but has no SUCCESS rows (prior GUI bug), returns "1.0.0" so all idempotent upgrades are attempted rather than treating it as a fresh install.
• Upgrade timeout: 5min → 1hr — compress_query_stats data migration timed out on 240GB+ databases at the old 300s CommandTimeout.

Root cause

PR #431 added install/00_uninstall.sql as a standalone script for SSMS users. Both installers build their file list by globbing install/*.sql sorted alphabetically — so 00_uninstall.sql became the first file executed on every install, including upgrades. Pre-release testing on small databases didn't catch it because there was no data to miss.

Test plan

• CLI fresh install (--reinstall): verify 00_uninstall.sql does NOT appear in the execution log
• CLI upgrade install: verify upgrades run, then install scripts start from 01_install_database.sql
• CLI upgrade with simulated failure: verify installer aborts with exit code 8 and does NOT proceed to install
• GUI upgrade install: same verification — upgrades then install, no 00_uninstall
• GUI upgrade with failure: verify abort message appears, install does not proceed
• Version detection with empty installation_history: verify "1.0.0" fallback, upgrades attempted
• --uninstall flag still works (uses its own code path, not the file list)
• Data survival: capture row counts before upgrade, verify equal or greater after

🤖 Generated with Claude Code

[HannahVernon]

Should we check if a database backup has occurred recently for upgrades, and warn the user with a "do you want to proceed?" message?

[erikdarlingdata]

@HannahVernon I've thought about things like this, including adding a backup option to the installer for the upgrade process, but there's a lot of moving parts and potential permissions issues, and of course confusion if AGs are in use and backups are being taken elsewhere. It's not impossible, but it is not something I'd feel very confident executing on.