refactor: rename cli-v2 → cli, archive legacy cli, plus broker-side grants + auto-migrate

- apps/cli/ is now the canonical CLI (was apps/cli-v2/).
- apps/cli/ legacy v0 archived as branch 'legacy-cli-archive' and tag
  'cli-v0-legacy-final' before deletion; git history preserves it too.
- .github/workflows/release-cli.yml paths updated.
- pnpm-lock.yaml regenerated.

Broker-side peer-grant enforcement (spec: 2026-04-15-per-peer-capabilities):
- 0020_peer-grants.sql adds peer_grants jsonb + GIN index on mesh.member.
- handleSend in broker fetches recipient grant maps once per send, drops
  messages silently when sender lacks the required capability.
- POST /cli/mesh/:slug/grants to update from CLI; broker_messages_dropped_by_grant_total metric.
- CLI grant/revoke/block now mirror to broker via syncToBroker.

Auto-migrate on broker startup:
- apps/broker/src/migrate.ts runs drizzle migrate with pg_advisory_lock
  before the HTTP server binds. Exits non-zero on failure so Coolify
  healthcheck fails closed.
- Dockerfile copies packages/db/migrations into /app/migrations.
- postgres 3.4.5 added as direct broker dep.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.github/workflows/release-cli.yml

@@ -5,7 +5,7 @@ name: Release CLI binaries
 # (x64 + arm64) and attaches them to a GitHub Release. The `install.sh`
 # fallback path curls these when Node isn't available.
 #
-# Publishing to npm is still a manual step (pnpm publish from apps/cli-v2) —
+# Publishing to npm is still a manual step (pnpm publish from apps/cli) —
 # this workflow only handles binary distribution.
 
 on:
@@ -48,7 +48,7 @@ jobs:
         run: pnpm install --frozen-lockfile --ignore-scripts
 
       - name: Compile binary
-        working-directory: apps/cli-v2
+        working-directory: apps/cli
         shell: bash
         run: |
           mkdir -p dist/bin
@@ -64,7 +64,7 @@ jobs:
       # on the build host, so skip them.
       - name: Smoke test (native only)
         if: matrix.target == 'darwin-arm64' || matrix.target == 'linux-x64'
-        working-directory: apps/cli-v2
+        working-directory: apps/cli
         run: |
           ./dist/bin/claudemesh-${{ matrix.target }} --version
           ./dist/bin/claudemesh-${{ matrix.target }} --help | head -5
@@ -73,7 +73,7 @@ jobs:
         uses: actions/upload-artifact@v4
         with:
           name: claudemesh-${{ matrix.target }}
-          path: apps/cli-v2/dist/bin/claudemesh-${{ matrix.target }}${{ matrix.ext }}
+          path: apps/cli/dist/bin/claudemesh-${{ matrix.target }}${{ matrix.ext }}
 
   release:
     needs: build