feat(gateway/make): PR6 T6.14 — migrate-paths target + lifespan warning

`app/gateway/app.py:_check_path_migration_pending` runs at lifespan
startup and emits a single WARNING log when `{base_dir}/users/` still
has content — the operator's cue to run the new migration script. The
warning is best-effort (silent on permission errors) so it can never
escalate into a gateway boot failure; reads from the legacy tree keep
working via the `user_id` branch of `Paths.thread_dir` until the
migration runs.

The root Makefile gains a `migrate-paths` target that wraps
`scripts/migrate_paths_to_workspace.py`. Two opt-in env knobs:
- `DRY_RUN=1`           — pass `--dry-run` (preview only, no writes)
- `DEFAULT_WORKSPACE=…`  — claim un-assigned users under this workspace id
   (defaults to `legacy_workspace` to align with PR5's orphan-row bucket).
`help` documents the new target.

3 tests cover the warning's three states (legacy dir with content, dir
missing, dir empty).

backend/tests/test_path_migration_pending_warning.py

@@ -0,0 +1,45 @@
+"""PR6 T6.14 — lifespan warns when legacy users/ tree still has content."""
+
+from __future__ import annotations
+
+import logging
+from pathlib import Path
+from unittest.mock import patch
+
+import pytest
+
+from app.gateway.app import _check_path_migration_pending
+
+
+class _FakePaths:
+    def __init__(self, base: Path):
+        self.base_dir = base
+
+
+@pytest.fixture
+def base(tmp_path: Path) -> Path:
+    return tmp_path
+
+
+def _patch_paths(base: Path):
+    return patch("deerflow.config.paths.get_paths", return_value=_FakePaths(base))
+
+
+def test_warns_when_legacy_users_dir_has_content(base: Path, caplog: pytest.LogCaptureFixture):
+    (base / "users" / "alice" / "threads" / "t1").mkdir(parents=True)
+    with _patch_paths(base), caplog.at_level(logging.WARNING, logger="app.gateway.app"):
+        _check_path_migration_pending(app=None)  # type: ignore[arg-type]
+    assert any("make migrate-paths" in rec.message for rec in caplog.records)
+
+
+def test_silent_when_legacy_users_dir_missing(base: Path, caplog: pytest.LogCaptureFixture):
+    with _patch_paths(base), caplog.at_level(logging.WARNING, logger="app.gateway.app"):
+        _check_path_migration_pending(app=None)  # type: ignore[arg-type]
+    assert not any("migrate-paths" in rec.message for rec in caplog.records)
+
+
+def test_silent_when_legacy_users_dir_empty(base: Path, caplog: pytest.LogCaptureFixture):
+    (base / "users").mkdir()
+    with _patch_paths(base), caplog.at_level(logging.WARNING, logger="app.gateway.app"):
+        _check_path_migration_pending(app=None)  # type: ignore[arg-type]
+    assert not any("migrate-paths" in rec.message for rec in caplog.records)