config-as-code: migrate contributor-cap/review-nag/rate-limit/misc-agent settings off the DB

[JSONbored]

Part of #6440.

Fields: `autoMaintainJson` (`autoMaintain`), `contributorOpenPrCap`, `contributorOpenIssueCap`, `contributorCapLabel`, `contributorCapCancelCi`, `reviewNagPolicy`, `reviewNagMaxPings`, `reviewNagCooldownDays`, `reviewNagLabel`, `reviewNagMonitoredMentionsJson`, `autoCloseExemptLoginsJson`, `accountAgeThresholdDays`, `newAccountLabel`, `commandRateLimitPolicy`, `commandRateLimitMaxPerWindow`, `commandRateLimitAiMaxPerWindow`, `commandRateLimitWindowHours`, `projectMilestoneMatchMode` (`autoProjectMilestoneMatch`), `autoProjectMilestoneMatchBackend`.

Explicitly EXCLUDED from this migration and must stay DB-only: `agentPaused`, `agentDryRun` — incident kill-switches that must take effect instantly without a PR+CI+merge cycle. Do not add a manifest path for these.

[linear-code]

JSO-4441

[JSONbored]

Confirmed ready as-is — no embedded open question here, unlike #6444/#6446. This is a DB-removal-only
mechanical migration with clear precedent (backfill → stop reading as a merge base → drop the DB columns
via migration → remove from the dashboard write path) and no business decision involved. The
agentPaused/agentDryRun exclusion is already explicit in the issue body (incident kill-switches that
must stay DB-only, no manifest path) — nothing left ambiguous. Unlocking for contributors.