fix: user:backfill-handles opens its own database

- without a published *gorm.DB the command opens one with lagoon.OpenFromApp
  for its run and closes it, as the plugin's other commands do (withDB)
- TestBackfillHandlesOpensFromConfigWhenUnpublished; README CLI note

README.md

@@ -222,6 +222,8 @@ Defaults live in `config/config.yaml` and are merged under `golem15.user.*`. Any
 | `user:token:list` | List token metadata without secrets or hashes. |
 | `user:token:revoke <id>` | Revoke a shared API token immediately. |
 
+Each command uses the database the serve command published or, run from the console, opens one from `database.dsn` (and loads the encryption keys from `app.key`) for its duration.
+
 ## Dependencies
 
 - The SummerCMS framework, `git.golem15.com/golem15/summercms` (modules `backpack`, `bonfire`, `bouncer`, `pact`, `party`, `surf` and others).