Data repairs run as controlled migrations

The backfill that repaired the invoices runs only behind an opt-in flag the scheduler never sets, and its before/after snapshots are diffed field by field. The repair restored 310 units and $3,881.50 of contractor pay across 8 invoices — and the diff proves exactly 8 records changed, with no unintended writes.