Database migration doesn't allow for rollback

[atbrandt]

The current database migration script is very rudimentary. It simply checks to see if there's a migration sql script with a newer version than the current database version, then performs migration by executing the sql inside the script, then goes on with its life. We should ideally never be pushing migration scripts that cause problems, but it can be hard to account for every scenario, so we should offer the ability to roll back a database to at least one previous state before migration, in the case of catastrophic failure.