refactor: rename cli-v2 → cli, archive legacy cli, plus broker-side grants + auto-migrate

- apps/cli/ is now the canonical CLI (was apps/cli-v2/).
- apps/cli/ legacy v0 archived as branch 'legacy-cli-archive' and tag
  'cli-v0-legacy-final' before deletion; git history preserves it too.
- .github/workflows/release-cli.yml paths updated.
- pnpm-lock.yaml regenerated.

Broker-side peer-grant enforcement (spec: 2026-04-15-per-peer-capabilities):
- 0020_peer-grants.sql adds peer_grants jsonb + GIN index on mesh.member.
- handleSend in broker fetches recipient grant maps once per send, drops
  messages silently when sender lacks the required capability.
- POST /cli/mesh/:slug/grants to update from CLI; broker_messages_dropped_by_grant_total metric.
- CLI grant/revoke/block now mirror to broker via syncToBroker.

Auto-migrate on broker startup:
- apps/broker/src/migrate.ts runs drizzle migrate with pg_advisory_lock
  before the HTTP server binds. Exits non-zero on failure so Coolify
  healthcheck fails closed.
- Dockerfile copies packages/db/migrations into /app/migrations.
- postgres 3.4.5 added as direct broker dep.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/cli/src/commands/uninstall.ts

@@ -0,0 +1,58 @@
+import { readFileSync, writeFileSync, existsSync } from "node:fs";
+import { PATHS } from "~/constants/paths.js";
+import { green, icons } from "~/ui/styles.js";
+import { EXIT } from "~/constants/exit-codes.js";
+
+export async function uninstall(): Promise<number> {
+  let removed = 0;
+
+  // Remove MCP server from ~/.claude.json
+  if (existsSync(PATHS.CLAUDE_JSON)) {
+    try {
+      const raw = readFileSync(PATHS.CLAUDE_JSON, "utf-8");
+      const config = JSON.parse(raw) as Record<string, unknown>;
+      const servers = config.mcpServers as Record<string, unknown> | undefined;
+      if (servers && "claudemesh" in servers) {
+        delete servers.claudemesh;
+        writeFileSync(PATHS.CLAUDE_JSON, JSON.stringify(config, null, 2) + "\n", "utf-8");
+        console.log(`  ${green(icons.check)} Removed MCP server from ~/.claude.json`);
+        removed++;
+      }
+    } catch {}
+  }
+
+  // Remove only claudemesh hooks from ~/.claude/settings.json
+  if (existsSync(PATHS.CLAUDE_SETTINGS)) {
+    try {
+      const raw = readFileSync(PATHS.CLAUDE_SETTINGS, "utf-8");
+      const config = JSON.parse(raw) as Record<string, unknown>;
+      const hooks = config.hooks as Record<string, unknown[]> | undefined;
+      if (hooks) {
+        let removedHooks = 0;
+        for (const [event, entries] of Object.entries(hooks)) {
+          if (!Array.isArray(entries)) continue;
+          const filtered = entries.filter((h: unknown) => {
+            const cmd = typeof h === "object" && h !== null && "command" in h ? String((h as Record<string, unknown>).command) : "";
+            return !cmd.includes("claudemesh");
+          });
+          if (filtered.length < entries.length) {
+            removedHooks += entries.length - filtered.length;
+            if (filtered.length === 0) delete hooks[event];
+            else hooks[event] = filtered;
+          }
+        }
+        if (removedHooks > 0) {
+          writeFileSync(PATHS.CLAUDE_SETTINGS, JSON.stringify(config, null, 2) + "\n", "utf-8");
+          console.log(`  ${green(icons.check)} Removed ${removedHooks} claudemesh hook(s) from settings.json`);
+          removed++;
+        }
+      }
+    } catch {}
+  }
+
+  if (removed === 0) {
+    console.log("  Nothing to remove — claudemesh was not installed.");
+  }
+
+  return EXIT.SUCCESS;
+}