Move default data/db path to a user-owned home directory (~/.sideshow)

[benvinegar]

Problem

The default SQLite db path is package-relative: <package-root>/data/sideshow.db, derived in server/index.ts (SIDESHOW_DATA → SIDESHOW_DB, both defaulting under <root>/data/). This causes two distinct failure modes, only the first of which #157 fixed:

1. Missing parent dir (ENOENT) — fixed by fix: create sqlite db parent directory before opening #157. node:sqlite does not create parent dirs, and the package ships no data/ folder, so npx sideshow serve and nvm-global installs (user-owned node_modules) crashed on first run. The mkdirSync(dirname(path), { recursive: true }) guard in createSqliteStorage resolved this.

2. Read-only package dir (EACCES) — still broken. A sudo npm install -g sideshow puts the package under /usr/lib/node_modules/, which is root-owned. The mkdir guard then throws EACCES (permission denied), not ENOENT, and the server still crashes. Repro: chmod 555 the parent of SIDESHOW_DB and boot.

3. Data wiped on reinstall (latent data loss). Even when writable, data living under node_modules/sideshow/data/ is deleted by npm install -g on upgrade. A user who runs sideshow for weeks, upgrades, and loses their workspace has no warning.

Proposal

Default the data/db path to a user-owned home location — ~/.sideshow/sideshow.{json,db} (or XDG: ~/.local/share/sideshow/). Specifically:

• Change the SIDESHOW_DATA / SIDESHOW_DB defaults in server/index.ts to resolve under the home dir rather than the package root.
• Keep both env overrides working unchanged.
• Keep the mkdirSync guard from fix: create sqlite db parent directory before opening #157 as defense-in-depth (a user may still point SIDESHOW_DB into a not-yet-created dir).
• Add a one-time migration of an existing <package-root>/data/sideshow.{db,json} → ~/.sideshow/, mirroring the existing migrateJsonToSqlite pattern (sentinel setting, idempotent, never overwrites non-empty target).

Context

• fix: create sqlite db parent directory before opening #157 merged the mkdirSync guard (fixes the npx / user-owned-global ENOENT case). This issue covers the remaining EACCES case + the reinstall-data-loss case.
• The home-dir default is the standard pattern for CLI tools that persist user data outside their install location.

Acceptance

• sudo npm install -g sideshow && sideshow serve boots without SIDESHOW_DB set, writing to ~/.sideshow/.
• Upgrading the global install preserves user data (no longer under node_modules).
• Existing users with data under the old <pkg>/data/ location are migrated once on boot.
• :memory: contract suite and all SIDESHOW_* overrides unchanged.