refactor: rename cli-v2 → cli, archive legacy cli, plus broker-side grants + auto-migrate

- apps/cli/ is now the canonical CLI (was apps/cli-v2/).
- apps/cli/ legacy v0 archived as branch 'legacy-cli-archive' and tag
  'cli-v0-legacy-final' before deletion; git history preserves it too.
- .github/workflows/release-cli.yml paths updated.
- pnpm-lock.yaml regenerated.

Broker-side peer-grant enforcement (spec: 2026-04-15-per-peer-capabilities):
- 0020_peer-grants.sql adds peer_grants jsonb + GIN index on mesh.member.
- handleSend in broker fetches recipient grant maps once per send, drops
  messages silently when sender lacks the required capability.
- POST /cli/mesh/:slug/grants to update from CLI; broker_messages_dropped_by_grant_total metric.
- CLI grant/revoke/block now mirror to broker via syncToBroker.

Auto-migrate on broker startup:
- apps/broker/src/migrate.ts runs drizzle migrate with pg_advisory_lock
  before the HTTP server binds. Exits non-zero on failure so Coolify
  healthcheck fails closed.
- Dockerfile copies packages/db/migrations into /app/migrations.
- postgres 3.4.5 added as direct broker dep.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/cli/src/commands/new.ts

@@ -0,0 +1,48 @@
+import { create as createMesh } from "~/services/mesh/facade.js";
+import { getStoredToken } from "~/services/auth/facade.js";
+import { green, dim, icons } from "~/ui/styles.js";
+import { EXIT } from "~/constants/exit-codes.js";
+
+export async function newMesh(
+  name: string,
+  opts: { template?: string; description?: string; json?: boolean },
+): Promise<number> {
+  if (!name) {
+    console.error("  Usage: claudemesh mesh create <name>");
+    return EXIT.INVALID_ARGS;
+  }
+
+  if (!getStoredToken()) {
+    console.log(dim("  Not signed in — starting login…\n"));
+    const { login } = await import("./login.js");
+    const loginResult = await login();
+    if (loginResult !== EXIT.SUCCESS) return loginResult;
+    console.log("");
+  }
+
+  try {
+    const result = await createMesh(name, {
+      template: opts.template,
+      description: opts.description,
+    });
+
+    if (opts.json) {
+      console.log(JSON.stringify({ schema_version: "1.0", ...result }, null, 2));
+    } else {
+      console.log(`\n  ${green(icons.check)} Created "${result.slug}" (id: ${result.id})`);
+      console.log(`  ${green(icons.check)} You're the owner`);
+      console.log(`  ${green(icons.check)} Joined locally`);
+      console.log(`\n  Share with: claudemesh mesh share\n`);
+    }
+
+    return EXIT.SUCCESS;
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (msg.includes("409") || msg.includes("already exists")) {
+      console.error(`  ${icons.cross} A mesh with this name already exists. Try a different name.`);
+    } else {
+      console.error(`  ${icons.cross} Failed: ${msg}`);
+    }
+    return EXIT.INTERNAL_ERROR;
+  }
+}