constraints: add constraint / drop constraint on existing columns (ADR-0029 §2.2)

Adds the two commands for modifying a column's constraints after
creation, completing ADR-0029's §2.2 surface.

Grammar (dsl/grammar/ddl.rs): `add constraint <constraint> to
<T>.<col>` reuses the §2.1 COLUMN_CONSTRAINT choice; `drop
constraint <kind> from <T>.<col>` names only the kind. Both join
the `add` / `drop` choices, discriminated by the `constraint`
form word.

AST (dsl/command.rs): `Command::AddConstraint` / `DropConstraint`
plus the `Constraint` / `ConstraintKind` enums.

Worker (db.rs): `do_add_constraint` / `do_drop_constraint` apply
the change through the rebuild-table primitive. `add` runs the §5
dry-run first — `not null` / `unique` / `check` against a
populated column are refused, before any write, with a
pretty-printed table of offending rows. §9 redundant-on-PK
declarations and §6 `default` on an auto-generated column are
friendly refusals; dropping a constraint the column does not
carry is likewise refused.

Also fixes schema_to_ddl, which suppressed UNIQUE for every PK
column — a compound-PK member is not individually unique, so an
explicit UNIQUE on it must survive the rebuild.

23 tests added (6 grammar, 17 worker); 3 completion-test and 3
matrix snapshots updated for the new `constraint` subcommand.

src/friendly/translate.rs

@@ -67,6 +67,8 @@ pub enum Operation {
     DropRelationship,
     AddIndex,
     DropIndex,
+    AddConstraint,
+    DropConstraint,
     Query,
     Rebuild,
     Replay,
@@ -96,6 +98,8 @@ impl Operation {
             Self::DropRelationship => "drop relationship",
             Self::AddIndex => "add index",
             Self::DropIndex => "drop index",
+            Self::AddConstraint => "add constraint",
+            Self::DropConstraint => "drop constraint",
             Self::Query => "query",
             Self::Rebuild => "rebuild",
             Self::Replay => "replay",