CLI: explicit 'paskia migrate' subcommand for legacy conversion

Serve never converts databases: with no paskia.kantadb it points at
'paskia init', or at 'paskia migrate' when legacy *.paskiadb candidates
exist. migrate converts a lone candidate, or the one named by --rp-id
when several exist; the rest stay in place. devserver fails fast with
the same hint. gitignore covers paskia.kantadb and *.converted-bak.

scripts/devserver.py

@@ -151,11 +151,16 @@ def ensure_database(rp_ids: list[str], args: argparse.Namespace, listen: str) ->
     """Bootstrap paskia.kantadb via 'paskia init' when no database exists.
 
     Realm options are init-only; 'paskia' (serve) reads all configuration
-    from the database. A legacy *.paskiadb database is adopted by serve,
-    so no init is run in that case either.
+    from the database. A legacy *.paskiadb database must be converted with
+    'paskia migrate' first.
     """
-    if db_file_path().exists() or find_legacy_databases():
+    if db_file_path().exists():
         return
+    if find_legacy_databases():
+        raise SystemExit(
+            "Legacy *.paskiadb database found — run 'paskia migrate' to "
+            "convert it before starting the dev server."
+        )
 
     cmd = [sys.executable, "-m", "paskia", "init", f"--listen={listen}"]
     for rp_id in rp_ids: