refactor: rename cli-v2 → cli, archive legacy cli, plus broker-side grants + auto-migrate

- apps/cli/ is now the canonical CLI (was apps/cli-v2/).
- apps/cli/ legacy v0 archived as branch 'legacy-cli-archive' and tag
  'cli-v0-legacy-final' before deletion; git history preserves it too.
- .github/workflows/release-cli.yml paths updated.
- pnpm-lock.yaml regenerated.

Broker-side peer-grant enforcement (spec: 2026-04-15-per-peer-capabilities):
- 0020_peer-grants.sql adds peer_grants jsonb + GIN index on mesh.member.
- handleSend in broker fetches recipient grant maps once per send, drops
  messages silently when sender lacks the required capability.
- POST /cli/mesh/:slug/grants to update from CLI; broker_messages_dropped_by_grant_total metric.
- CLI grant/revoke/block now mirror to broker via syncToBroker.

Auto-migrate on broker startup:
- apps/broker/src/migrate.ts runs drizzle migrate with pg_advisory_lock
  before the HTTP server binds. Exits non-zero on failure so Coolify
  healthcheck fails closed.
- Dockerfile copies packages/db/migrations into /app/migrations.
- postgres 3.4.5 added as direct broker dep.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/cli/src/services/api/public.ts

@@ -0,0 +1,46 @@
+import { post, get, request } from "./client.js";
+import { URLS } from "~/constants/urls.js";
+
+const BROKER_HTTP = URLS.BROKER.replace("wss://", "https://").replace("ws://", "http://").replace("/ws", "");
+
+export async function claimInvite(code: string, body: { pubkey: string; display_name: string }) {
+  return post<{
+    meshId: string;
+    memberId: string;
+    slug: string;
+    name: string;
+    brokerUrl: string;
+    rootKey?: string;
+  }>(`/api/public/invites/${code}/claim`, body);
+}
+
+export async function requestDeviceCode(deviceInfo: {
+  hostname: string;
+  platform: string;
+  arch: string;
+}) {
+  return request<{
+    device_code: string;
+    user_code: string;
+    session_id: string;
+    expires_at: string;
+    verification_url: string;
+    token_url: string;
+  }>({
+    path: "/cli/device-code",
+    method: "POST",
+    body: deviceInfo,
+    baseUrl: BROKER_HTTP,
+  });
+}
+
+export async function pollDeviceCode(deviceCode: string) {
+  return request<{
+    status: "pending" | "approved" | "expired";
+    session_token?: string;
+    user?: { id: string; display_name: string; email: string };
+  }>({
+    path: `/cli/device-code/${deviceCode}`,
+    baseUrl: BROKER_HTTP,
+  });
+}