fix: enable foreign_keys pragma and add missing indexes

- Add `PRAGMA foreign_keys = ON` to db.ts — without this, all
  ON DELETE CASCADE constraints across 7 tables are silently ignored
  (SQLite disables foreign keys by default)
- Add migration 015 with indexes on hot query paths:
  notifications(read_at), notifications(recipient, read_at),
  activities(actor), activities(entity_type, entity_id),
  messages(read_at)

README.md

@@ -106,7 +106,7 @@ mission-control/
 │   ├── lib/
 │   │   ├── auth.ts            # Session + API key auth, RBAC
 │   │   ├── db.ts              # SQLite (better-sqlite3, WAL mode)
-│   │   ├── migrations.ts      # 14 schema migrations
+│   │   ├── migrations.ts      # 15 schema migrations
 │   │   ├── scheduler.ts       # Background task scheduler
 │   │   ├── webhooks.ts        # Outbound webhook delivery
 │   │   └── websocket.ts       # Gateway WebSocket client

src/lib/db.ts

@@ -23,6 +23,7 @@ export function getDatabase(): Database.Database {
     db.pragma('journal_mode = WAL');
     db.pragma('synchronous = NORMAL');
     db.pragma('cache_size = 1000');
+    db.pragma('foreign_keys = ON');
     
     // Initialize schema if needed
     initializeSchema();

src/lib/migrations.ts

@@ -424,6 +424,18 @@ const migrations: Migration[] = [
       db.exec(`CREATE INDEX IF NOT EXISTS idx_users_provider ON users(provider)`)
       db.exec(`CREATE INDEX IF NOT EXISTS idx_users_email ON users(email)`)
     }
+  },
+  {
+    id: '015_missing_indexes',
+    up: (db) => {
+      db.exec(`
+        CREATE INDEX IF NOT EXISTS idx_notifications_read_at ON notifications(read_at);
+        CREATE INDEX IF NOT EXISTS idx_notifications_recipient_read ON notifications(recipient, read_at);
+        CREATE INDEX IF NOT EXISTS idx_activities_actor ON activities(actor);
+        CREATE INDEX IF NOT EXISTS idx_activities_entity ON activities(entity_type, entity_id);
+        CREATE INDEX IF NOT EXISTS idx_messages_read_at ON messages(read_at);
+      `)
+    }
   }
 ]