fix(water-log): add missing pin_hash column on water_admin_settings

The Drizzle schema in db/schema/water-log.ts declares
`water_admin_settings.pin_hash TEXT` for the hashed admin PIN, but
the table was originally created in 0090_water_log_completion.sql
WITHOUT that column. The earlier 0004 migration was a no-op against
prod (table already existed from 0090) and so did not add it either.

Effect: every Drizzle `select()` / `insert()` against the table
throws 'column pin_hash does not exist', which:

  - /api/water-admin-auth catches and returns 500 'Server error'
  - /admin/water-log/settings never finishes loading (the action's
    promise rejects inside withBrand, so LOAD_DONE is never
    dispatched, and the page sits on the Loading… state)

Migration adds the column with IF NOT EXISTS so it's safe to re-run
and won't error on a brand whose row already has a hash.

db/migrations/0005_water_admin_pin_hash.sql

@@ -0,0 +1,19 @@
+-- ============================================================================
+-- 0005_water_admin_pin_hash.sql
+--
+-- The Drizzle schema (db/schema/water-log.ts) declares
+-- `water_admin_settings.pin_hash TEXT` for storing the hashed admin PIN.
+-- The original table was created in 0090_water_log_completion.sql without
+-- that column, so every Drizzle `select()` / `insert()` against the table
+-- throws `column "pin_hash" does not exist`, which the water-admin auth
+-- route surfaces as 500 "Server error" and the settings page can't load
+-- (the action's promise rejects inside withBrand, leaving the page stuck
+-- on "Loading…").
+--
+-- The 0004 migration that previously created this table was a no-op
+-- against prod (the table already existed from 0090) and so didn't add
+-- the column either. This migration fixes that.
+-- ============================================================================
+
+ALTER TABLE water_admin_settings
+  ADD COLUMN IF NOT EXISTS pin_hash TEXT;