pub fn migrate_if_needed(conn: &Connection, now: &str) -> Result<(), String>
Migrate on its own transaction (the read path). Cheap when nothing is pending.