ship(P02): doctor network + db merged into v0.3 milestone

---ci---
project: orca
phase: 2
milestone: v0.3
status: complete
requirements:
  covered: [REQ-032]
  partial: []
---/ci---

P02: orca doctor network + db full implementation.
- DB(): PRAGMA integrity_check + MigrationVersion (PASS/WARN/FAIL)
- Network(): mTLS /healthz probe per peer, 3s timeout, zero peers → WARN
- certpaths.DBPath() relocation (D-039, breaks import cycle)
- store.MigrationVersion() public API
- Deleted NetworkStub/DBStub (D-040)
- 7 doctor tests + 1 MigrationVersion test, all pass under -race
- 4-layer verification passed

internal/cli/doctor.go

@@ -51,7 +51,7 @@ var doctorNetworkCmd = &cobra.Command{
 	Use:   "network",
 	Short: "Run the network self-check (P02 impl)",
 	RunE: func(cmd *cobra.Command, args []string) error {
-		c := doctor.NetworkStub()
+		c := doctor.Network()
 		r, msg := c.Run(cmd.Context())
 		fmt.Fprintf(cmd.OutOrStdout(), "%-20s %-5s  %s\n", c.Name, r, msg)
 		return nil
@@ -62,7 +62,7 @@ var doctorDBCmd = &cobra.Command{
 	Use:   "db",
 	Short: "Run the database self-check (P02 impl)",
 	RunE: func(cmd *cobra.Command, args []string) error {
-		c := doctor.DBStub()
+		c := doctor.DB()
 		r, msg := c.Run(cmd.Context())
 		fmt.Fprintf(cmd.OutOrStdout(), "%-20s %-5s  %s\n", c.Name, r, msg)
 		return nil

internal/cli/node.go

@@ -8,7 +8,6 @@ import (
 	"log/slog"
 	"os"
 	"os/signal"
-	"path/filepath"
 	"syscall"
 	"time"
 
@@ -22,16 +21,8 @@ import (
 	"git.cloudinit.dev/coreci/orca/internal/store"
 )
 
-func dbPath() string {
-	if p := os.Getenv("ORCA_DB"); p != "" {
-		return p
-	}
-	home, _ := os.UserHomeDir()
-	return filepath.Join(home, ".orca", "orca.db")
-}
-
 func openDB() (*sql.DB, func() error, error) {
-	db, err := store.Open(dbPath())
+	db, err := store.Open(certpaths.DBPath())
 	if err != nil {
 		return nil, nil, err
 	}