refactor: rename database → storage

More semantically accurate: contains SQLite files, schema, fixtures, test data.
Updated all references in code, scripts, docs.

docs/SECURITY_ANALYSIS.md

@@ -369,7 +369,7 @@ rest of the codebase which uses `htmlspecialchars()` everywhere.
 **File:** `config/bootstrap.php`
 
 ```php
-define('DATABASE_PATH', APP_ROOT . '/database/test.db');
+define('DATABASE_PATH', APP_ROOT . '/storage/test.db');
 ```
 
 This constant is never used anywhere. `Database.php` uses `getDatabasePath()` from