store: triggers refuse deleting an owner that still owns repositories !201

The last item of #136. repos.owner_id is polymorphic over users and orgs, so no foreign key can hold it, and integrity rested on the checks in DeleteUser and DeleteOrg. Migration 0033 adds BEFORE DELETE triggers on users and orgs that abort while repositories remain, so a direct or buggy delete cannot orphan a repository either. The application guards stay and give the friendlier message.

TestOwnerDeleteRefusedWhileReposRemain deletes both owner kinds directly with and without repositories; the migration round-trip test covers the down.

Stacked on !200; no code dependency.

Closes #136