constraints: add constraint / drop constraint on existing columns (ADR-0029 §2.2)

Adds the two commands for modifying a column's constraints after
creation, completing ADR-0029's §2.2 surface.

Grammar (dsl/grammar/ddl.rs): `add constraint <constraint> to
<T>.<col>` reuses the §2.1 COLUMN_CONSTRAINT choice; `drop
constraint <kind> from <T>.<col>` names only the kind. Both join
the `add` / `drop` choices, discriminated by the `constraint`
form word.

AST (dsl/command.rs): `Command::AddConstraint` / `DropConstraint`
plus the `Constraint` / `ConstraintKind` enums.

Worker (db.rs): `do_add_constraint` / `do_drop_constraint` apply
the change through the rebuild-table primitive. `add` runs the §5
dry-run first — `not null` / `unique` / `check` against a
populated column are refused, before any write, with a
pretty-printed table of offending rows. §9 redundant-on-PK
declarations and §6 `default` on an auto-generated column are
friendly refusals; dropping a constraint the column does not
carry is likewise refused.

Also fixes schema_to_ddl, which suppressed UNIQUE for every PK
column — a compound-PK member is not individually unique, so an
explicit UNIQUE on it must survive the rebuild.

23 tests added (6 grammar, 17 worker); 3 completion-test and 3
matrix snapshots updated for the new `constraint` subcommand.

src/friendly/strings/en-US.yaml

@@ -432,6 +432,7 @@ parse:
     drop_index: |-
       drop index <Name>
       drop index on <Table> (<col>[, ...])
+    drop_constraint: "drop constraint (not null | unique | default | check) from <Table>.<col>"
     add_column: "add column [to] [table] <Table>: <Name> (<Type>)"
     add_relationship: |-
       add 1:n relationship [as <Name>]
@@ -439,6 +440,11 @@ parse:
         [on delete <action>] [on update <action>]
         [--create-fk]
     add_index: "add index [as <Name>] on <Table> (<col>[, ...])"
+    add_constraint: |-
+      add constraint not null to <Table>.<col>
+      add constraint unique to <Table>.<col>
+      add constraint default <value> to <Table>.<col>
+      add constraint check (<expr>) to <Table>.<col>
     rename_column: "rename column [in] [table] <Table>: <Old> to <New>"
     change_column: |-
       change column [in] [table] <Table>: <Name> (<Type>)
@@ -727,6 +733,17 @@ db:
     # Follow-up suggestion appended to the lossy diagnostic
     # (only — incompatibles can't be force-overridden).
     force_conversion_hint: "if you want to execute this conversion in spite of the problems, re-run with `--force-conversion`."
+    # `add constraint ...` dry-run refusals (ADR-0029 §5).
+    # Surface when the column's existing rows would violate the
+    # constraint being added; the offending rows follow in a
+    # diagnostic table. There is no force override — the user
+    # fixes the data and retries.
+    add_not_null_summary: |-
+      Cannot add NOT NULL to `{table}.{column}`: {total} row(s) hold a null value.
+    add_unique_summary: |-
+      Cannot add UNIQUE to `{table}.{column}`: {total} value(s) appear in more than one row.
+    add_check_summary: |-
+      Cannot add this CHECK to `{table}.{column}`: {total} row(s) do not satisfy `{rule}`.
 
 # ---- DSL command success summaries (ADR-0019 §9 sweep) --------------
 ok: