Add nullable columns without a default

Deploying knowledge bases showed the migration runner doing the wrong thing:

    ALTER TABLE "documents" ADD COLUMN "base_id" VARCHAR(32) DEFAULT ''

`base_id` is nullable and its absent value is NULL, but the runner derived a
default from the column type and backfilled every existing row with the empty
string. Nothing then matched `base_id IS NULL`, so the startup sweep that files
pre-bases documents into a default base would have skipped all of them and the
documents would have stayed invisible.

Nobody lost anything -- the live instance had no documents yet -- but the fault
is general: any nullable column added from here would arrive as "" rather than
NULL, and every "is this set?" check would be wrong about the rows that predate
it. So a default is now emitted only for NOT NULL columns, where SQLite requires
one.

The sweep also accepts "" as meaning unfiled, since a deployment that upgraded
through the previous release has rows holding it.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/lembas/services/library/documents.py

@@ -133,7 +133,12 @@ def sweep_unfiled(db: DBSession) -> int:
     table that already had rows. This is what makes "always set" true in
     practice, and it runs at startup beside the orphaned-upload sweep.
     """
-    unfiled = list(db.scalars(select(Document).where(Document.base_id.is_(None))))
+    # Empty string as well as NULL: an earlier release added the column with a
+    # type-derived default, so a deployment that upgraded through it has rows
+    # holding "" rather than NULL. Both mean the same thing here.
+    unfiled = list(
+        db.scalars(select(Document).where((Document.base_id.is_(None)) | (Document.base_id == "")))
+    )
     if not unfiled:
         return 0