feat(cli,server): warn on deprecated config at load; scaffold version: 1

Surface the config deprecation notices at load: the CLI prints them via
`eprintln!` in `load_cli_config`; the server logs them via `tracing::warn!` in
`load_server_settings` (a no-op under tests with no subscriber). `omnigraph init`
now scaffolds a `version: 1` config using `storage:` instead of the legacy `uri:`.

Migrate the shared test fixtures (`support::local_yaml_config` →
`version: 1` + `storage:`; `remote_yaml_config` → `version: 1` + `servers:`/`server:`)
to the current schema so they don't trip the new warnings; the resolved `.uri` is
unchanged, so the tests behave identically. The no-`version:` notice is gated on a
loaded config file, so commands with a bare URI and no `omnigraph.yaml` stay quiet
(verified by the existing command-deprecation tests, which still pass). Extends the
`init` test for the scaffold shape and adds a legacy-config-warns test.

crates/omnigraph-cli/src/main.rs

@@ -776,6 +776,9 @@ fn load_env_file_into_process(path: &Path) -> Result<()> {
 
 fn load_cli_config(config_path: Option<&PathBuf>) -> Result<OmnigraphConfig> {
     let config = load_config(config_path)?;
+    for warning in config.deprecation_warnings() {
+        eprintln!("warning: {warning}");
+    }
     if let Some(path) = config.resolve_auth_env_file() {
         load_env_file_into_process(&path)?;
     }
@@ -1569,12 +1572,13 @@ fn scaffold_config_if_missing(uri: &str) -> Result<()> {
         path,
         format!(
             "\
+version: 1
 project:
   name: Omnigraph Project
 
 graphs:
   local:
-    uri: {}
+    storage: {}
     # bearer_token_env: OMNIGRAPH_BEARER_TOKEN
 
 server:

crates/omnigraph-cli/tests/cli.rs

@@ -232,7 +232,11 @@ fn init_creates_graph_successfully_on_missing_local_directory() {
     assert!(stdout.contains("initialized"));
     assert!(graph.join("_schema.pg").exists());
     assert!(graph.join("__manifest").exists());
-    assert!(temp.path().join("omnigraph.yaml").exists());
+    let scaffold = fs::read_to_string(temp.path().join("omnigraph.yaml")).unwrap();
+    assert!(
+        scaffold.contains("version: 1") && scaffold.contains("storage:"),
+        "init must scaffold a `version: 1` config using `storage:`; got:\n{scaffold}"
+    );
 }
 
 #[test]

crates/omnigraph-cli/tests/support/mod.rs

@@ -119,9 +119,10 @@ fn yaml_string(value: &str) -> String {
 pub fn local_yaml_config(graph: &Path) -> String {
     format!(
         "\
+version: 1
 graphs:
   local:
-    uri: {}
+    storage: {}
 cli:
   graph: local
   branch: main
@@ -137,9 +138,13 @@ policy: {{}}
 pub fn remote_yaml_config(url: &str) -> String {
     format!(
         "\
+version: 1
+servers:
+  dev:
+    endpoint: {}
 graphs:
   dev:
-    uri: {}
+    server: dev
 cli:
   graph: dev
   branch: main

crates/omnigraph-cli/tests/system_local.rs

@@ -301,6 +301,32 @@ fn local_cli_end_to_end_init_load_read_change_read_flow() {
     assert_eq!(inline_read["rows"][0]["p.age"], 42);
 }
 
+#[test]
+fn local_cli_warns_on_legacy_config_without_version() {
+    // A config with no `version:` is the deprecated legacy schema — loading it
+    // emits a migrate-to-`version: 1` warning on stderr (RFC-002 §Migration).
+    let graph = SystemGraph::loaded();
+    let config = graph.write_config(
+        "omnigraph.yaml",
+        &format!(
+            "graphs:\n  local:\n    uri: {}\ncli:\n  graph: local\n",
+            graph.path().display()
+        ),
+    );
+    let output = output_success(
+        cli()
+            .arg("snapshot")
+            .arg("--config")
+            .arg(&config)
+            .arg("--json"),
+    );
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    assert!(
+        stderr.contains("version: 1"),
+        "legacy config must warn to migrate to `version: 1`; stderr:\n{stderr}"
+    );
+}
+
 #[test]
 fn local_cli_end_to_end_branch_change_merge_flow() {
     let graph = SystemGraph::loaded();

crates/omnigraph-server/src/lib.rs

@@ -918,6 +918,9 @@ pub fn load_server_settings(
     cli_allow_unauthenticated: bool,
 ) -> Result<ServerConfig> {
     let config = load_config(config_path)?;
+    for warning in config.deprecation_warnings() {
+        warn!("{warning}");
+    }
     let bind = cli_bind.unwrap_or_else(|| config.server_bind().to_string());
     // Either `--unauthenticated` or `OMNIGRAPH_UNAUTHENTICATED=1` flips
     // this. Treat any non-empty, non-"0"/"false" string as truthy —