8 archive tables: service_role holds UPDATE/DELETE/TRUNCATE, append-only is convention not grant

All 9 tamper-evidence archive tables (comisionesArchive, periodosArchive, practicasArchive, practicaImagesArchive, practicaTeethArchive, practicaToothConductosArchive, studentAssignmentsArchive, teacherComisionMembershipsArchive, usersArchive) are append-only BY CONVENTION only — service_role (the app's runtime DB role) holds UPDATE/DELETE/TRUNCATE directly on all of them, nothing at the grant level prevents an app code path or compromised service_role key from mutating/erasing archive history. studentExamScoresArchive is the sole exception (already INSERT/SELECT only). Found during the fleet pg_temp SECURITY DEFINER sweep (2026-07-31) answering pmmaster's write-boundary-enforced-only-by-convention check. Fix (not yet applied, needs Class-A DDL review): REVOKE UPDATE, DELETE, TRUNCATE ON the 8 exposed tables FROM service_role, leaving INSERT/SELECT/TRIGGER/REFERENCES.