feat(t-paliad-070): rename Department → PartnerUnit on the Go side

Backend rename (frontend lands in next commit):
- Migration 026: rename paliad.departments → paliad.partner_units,
  paliad.department_members → paliad.partner_unit_members, junction FK
  department_id → partner_unit_id, plus all constraints/indexes/policies.
  Pre-drop seed re-runs migration 019's logic to capture any users.dezernat
  drift, then DROP COLUMN. Adds paliad.partner_unit_events audit table
  with RLS (any-authenticated read, global_admin write).
- models.User.Dezernat dropped. Department / DepartmentMember →
  PartnerUnit / PartnerUnitMember.
- DepartmentService → PartnerUnitService (file renamed via git mv to
  preserve blame). Every mutation now opens a tx and emits a
  partner_unit_events row in the same tx (created/updated/deleted/
  member_added/member_removed). Update emits before/after snapshots;
  Delete emits BEFORE the cascade so the FK still resolves, then
  ON DELETE SET NULL keeps the historical row.
- /api/departments/* → /api/partner-units/*. Handlers renamed.
- New /admin/partner-units page handler stub.
- AuditService UNIONs the new partner_unit_events source as a 4th
  branch; handler accepts AuditSourcePartnerUnitEvents.
- user_service: drop dezernat from CreateUserInput / UpdateProfileInput
  / AdminCreateInput / AdminUpdateInput. CreateUserInput gains
  PartnerUnitID *uuid.UUID — onboarding can pick an initial unit and
  the membership row + audit event are inserted in the same tx.
- Settings tab aliases drop dezernat/department.
- Legacy /dezernate and /departments now redirect to
  /admin/partner-units (admins only see it; non-admins land on the
  forbidden bounce).

go build / vet / test compile clean.

cmd/server/main.go

@@ -84,7 +84,7 @@ func main() {
 		users := services.NewUserService(pool)
 		projectSvc := services.NewProjectService(pool, users)
 		teamSvc := services.NewTeamService(pool, projectSvc)
-		departmentSvc := services.NewDepartmentService(pool, users)
+		partnerUnitSvc := services.NewPartnerUnitService(pool, users)
 		rules := services.NewDeadlineRuleService(pool)
 
 		// Phase F: optional CalDAV cipher. If CALDAV_ENCRYPTION_KEY is unset
@@ -114,7 +114,7 @@ func main() {
 		svcBundle = &handlers.Services{
 			Project:        projectSvc,
 			Team:           teamSvc,
-			Department:     departmentSvc,
+			PartnerUnit:    partnerUnitSvc,
 			Party:          services.NewPartyService(pool, projectSvc),
 			Deadline:       services.NewDeadlineService(pool, projectSvc),
 			Appointment:    appointmentSvc,