ci(db): migrate down above per_diem_rates and verify all four tables

[DEV-608](/DEV/issues/DEV-608) added migration
0004_approval_sessions.{up,down}.sql but did not update the DB job's
rollback step. The step still ran `migrate down 2`, which with four
migrations rolls back only 0004 + 0003 and leaves 0002_agents in place
— the hard-coded check "agents must be gone after down 2" then fails:

    FAIL: agents still present after migrate down 2

Fix: roll back all three migrations layered on top of
0001_per_diem_rates (`down 3`) and verify agents, agent_keys, AND
approval_sessions are all gone while per_diem_rates remains. Also
cover approval_sessions in the up-direction assertion so a future
"missed table" shows up in both halves of the test. A comment at the
new step names the invariant so the next migration bump is obvious.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.forgejo/workflows/validate.yml

@@ -236,22 +236,26 @@ jobs:
           grep -q ' per_diem_rates ' /tmp/dt-after-up.txt
           grep -q ' agents ' /tmp/dt-after-up.txt
           grep -q ' agent_keys ' /tmp/dt-after-up.txt
+          grep -q ' approval_sessions ' /tmp/dt-after-up.txt
 
-      - name: migrate down 2 + verify only agent tables gone
+      # Roll back everything on top of per_diem_rates (0001) — currently
+      # 0004_approval_sessions, 0003_agent_keys, 0002_agents — and verify
+      # per_diem_rates remains while the agent-side tables are gone. Keep
+      # this count equal to the number of migrations above 0001; bump when
+      # a new migration is added.
+      - name: migrate down (all above per_diem_rates) + verify
         working-directory: ${{ github.workspace }}
         run: |
           set -euo pipefail
-          migrate -path db/trust/migrations -database "${DB_URL}" down 2
+          migrate -path db/trust/migrations -database "${DB_URL}" down 3
           psql "${DB_URL}" -c '\dt' | tee /tmp/dt-after-down.txt
           grep -q ' per_diem_rates ' /tmp/dt-after-down.txt
-          if grep -q ' agents ' /tmp/dt-after-down.txt; then
+          for table in agents agent_keys approval_sessions; do
-            echo "FAIL: agents still present after migrate down 2" >&2
+            if grep -q " ${table} " /tmp/dt-after-down.txt; then
-            exit 1
+              echo "FAIL: ${table} still present after migrate down" >&2
-          fi
-          if grep -q ' agent_keys ' /tmp/dt-after-down.txt; then
-            echo "FAIL: agent_keys still present after migrate down 2" >&2
               exit 1
             fi
+          done
 
       - name: migrate up (re-apply) + apply seed + verify three agents
         working-directory: ${{ github.workspace }}