Zero-downtime migrations

Add columns nullable, backfill, then constrain. Rename via double-write. Drop last.