fix(switch-db): correct 14 false curated 10G-on-1G compatibility claims

Manual datasheet-verified correction, the one class the automated guards
(126/138/141) deliberately never touch: curated vendor_compat rows claiming
10G Flexoptix transceivers work in 1G-only switches. Verified against Cisco
primary docs 2026-07-18: ASR9000 transceiver support matrix (C78-624747-06)
shows A9K-40GE-L/B/E accept SFP only (XFP/SFP+/QSFP/CFP all No), and the
Catalyst 9300 datasheet specifies C9300-48S/24S as 1G SFP fixed downlinks
(10G only via separate NM uplink modules, tracked as own switch entities).
C9400-LC-48S/24S + C9600-LC-48S are 1G SFP line cards. Backup in
curated_compat_10g_on_1g_backup_20260718. v_switch_understated_ports now 0.

sql/144-fix-false-curated-10g-compat.sql

@@ -0,0 +1,49 @@
+-- sql/144-fix-false-curated-10g-compat.sql
+-- Manual, datasheet-verified correction of 14 CURATED (verification_method=
+-- 'vendor_compat') compatibility rows that claim 10G transceivers are
+-- compatible with switches whose ports are physically 1G-only.
+--
+-- The automated guards (126/138/141) deliberately never touch curated rows --
+-- on understated switches, curated data is normally the source of truth that
+-- RAISES the ceiling. These 14 rows are the documented exception: verified
+-- 2026-07-18 against Cisco's own primary documentation:
+--   * Cisco ASR 9000 Transceiver Module Support Matrix (C78-624747-06):
+--     A9K-40GE-L/B/E -- SFP=Yes, XFP=No, SFP+=No, QSFP=No, CFP=No. Supported
+--     SFP lists are exclusively 100M/1G-class (1000BASE SFP, CWDM "Gigabit
+--     Ethernet and 1G/2G FC", DWDM 1000BASE). No 10G module type accepted.
+--     A9K-40GE-TR is the packet-transport variant of the same 40-Port GE
+--     family (SFP cages only).
+--   * Cisco Catalyst 9300 Series Data Sheet (nb-06-cat9300-ser-...):
+--     "C9300-48S 48 ports 1G SFP Modular uplinks", "C9300-24S 24 ports 1G SFP
+--     Modular uplinks" -- fixed downlinks are 1G; 10G exists only on the
+--     separate, optional uplink network module, which TIP tracks as its own
+--     switch entity (e.g. C9300-NM-8X).
+--   * C9400-LC-48S / C9400-LC-24S / C9600-LC-48S: "48-port 1G SFP line card"
+--     per Cisco 9400/9600 line-card documentation (C9600-LC-48S slot
+--     bandwidth 96 Gbps full-duplex = 48x1G).
+--
+-- Likely origin of the bad rows: flexoptix-compat.ts (vendor_compat method)
+-- matching 10G Flexoptix parts (P.1696.23.yy, X.1696.23.yy, P.1596.40:Sx,
+-- P.Czz.z) to these switch records via the configurator supported-vendors
+-- family match -- same scraper lane that produced the sql/125 spec_match
+-- cleanup, this time in the curated tier.
+--
+-- Effect: v_switch_understated_ports drops to 0 (its rows were exactly these
+-- curated-faster-than-ports claims), removing the last "understated ports"
+-- alert class for these switches. Idempotent.
+
+create table if not exists curated_compat_10g_on_1g_backup_20260718 as
+select c.*, now() as backed_up_at
+from compatibility c
+where c.id in (select compat_id from v_switch_understated_ports);
+
+update compatibility c
+   set status = 'incompatible',
+       notes  = case when c.notes is null or c.notes = ''
+                     then 'manual(144): 10G transceiver on 1G-only switch; verified against Cisco ASR9000 transceiver support matrix (C78-624747-06) and Catalyst 9300/9400/9600 datasheets 2026-07-18'
+                     else c.notes || ' | manual(144): 10G transceiver on 1G-only switch; verified against Cisco primary datasheets 2026-07-18' end
+ where c.id in (select compat_id from v_switch_understated_ports);
+
+insert into _migrations (filename, applied_at)
+select '144-fix-false-curated-10g-compat.sql', now()
+where not exists (select 1 from _migrations where filename = '144-fix-false-curated-10g-compat.sql');