fix: unify goose Provider path and fail on pending migrations

Apply BasePath via fs.Sub, route CLI through Provider API, return
ErrPendingMigrations when auto-migrate is disabled, use DownTo for blank.

Co-authored-by: Cursor <cursoragent@cursor.com>

cli/doc.go

@@ -0,0 +1,5 @@
+// Package migratecli provides urfave/cli v3 commands for go-toolkit migrations.
+//
+// Commands load the migrations [app.Module] via [gitea.auvem.com/go-toolkit/appcli.DepFn]
+// before invoking the shared goose [Provider] API.
+package migratecli