refactor: rename cli-v2 → cli, archive legacy cli, plus broker-side grants + auto-migrate

- apps/cli/ is now the canonical CLI (was apps/cli-v2/).
- apps/cli/ legacy v0 archived as branch 'legacy-cli-archive' and tag
  'cli-v0-legacy-final' before deletion; git history preserves it too.
- .github/workflows/release-cli.yml paths updated.
- pnpm-lock.yaml regenerated.

Broker-side peer-grant enforcement (spec: 2026-04-15-per-peer-capabilities):
- 0020_peer-grants.sql adds peer_grants jsonb + GIN index on mesh.member.
- handleSend in broker fetches recipient grant maps once per send, drops
  messages silently when sender lacks the required capability.
- POST /cli/mesh/:slug/grants to update from CLI; broker_messages_dropped_by_grant_total metric.
- CLI grant/revoke/block now mirror to broker via syncToBroker.

Auto-migrate on broker startup:
- apps/broker/src/migrate.ts runs drizzle migrate with pg_advisory_lock
  before the HTTP server binds. Exits non-zero on failure so Coolify
  healthcheck fails closed.
- Dockerfile copies packages/db/migrations into /app/migrations.
- postgres 3.4.5 added as direct broker dep.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/cli/src/services/spawn/claude.ts

@@ -0,0 +1,37 @@
+import { spawnSync, type SpawnSyncReturns } from "node:child_process";
+import { existsSync } from "node:fs";
+
+export function findClaudeBinary(): string | null {
+  const candidates = [
+    process.env.CLAUDE_BIN,
+    "/usr/local/bin/claude",
+    `${process.env.HOME}/.local/bin/claude`,
+    `${process.env.HOME}/.npm/bin/claude`,
+  ].filter(Boolean) as string[];
+
+  for (const bin of candidates) {
+    if (existsSync(bin)) return bin;
+  }
+
+  const which = spawnSync("which", ["claude"], { encoding: "utf-8" });
+  if (which.status === 0 && which.stdout.trim()) return which.stdout.trim();
+
+  return null;
+}
+
+export interface SpawnClaudeOpts {
+  args: string[];
+  env?: Record<string, string>;
+  cwd?: string;
+}
+
+export function spawnClaude(opts: SpawnClaudeOpts): SpawnSyncReturns<Buffer> {
+  const bin = findClaudeBinary();
+  if (!bin) throw new Error("Claude binary not found. Install with: npm i -g @anthropic-ai/claude-code");
+
+  return spawnSync(bin, opts.args, {
+    stdio: "inherit",
+    env: { ...process.env, ...opts.env },
+    cwd: opts.cwd,
+  });
+}