refactor: rename cli-v2 → cli, archive legacy cli, plus broker-side grants + auto-migrate

- apps/cli/ is now the canonical CLI (was apps/cli-v2/).
- apps/cli/ legacy v0 archived as branch 'legacy-cli-archive' and tag
  'cli-v0-legacy-final' before deletion; git history preserves it too.
- .github/workflows/release-cli.yml paths updated.
- pnpm-lock.yaml regenerated.

Broker-side peer-grant enforcement (spec: 2026-04-15-per-peer-capabilities):
- 0020_peer-grants.sql adds peer_grants jsonb + GIN index on mesh.member.
- handleSend in broker fetches recipient grant maps once per send, drops
  messages silently when sender lacks the required capability.
- POST /cli/mesh/:slug/grants to update from CLI; broker_messages_dropped_by_grant_total metric.
- CLI grant/revoke/block now mirror to broker via syncToBroker.

Auto-migrate on broker startup:
- apps/broker/src/migrate.ts runs drizzle migrate with pg_advisory_lock
  before the HTTP server binds. Exits non-zero on failure so Coolify
  healthcheck fails closed.
- Dockerfile copies packages/db/migrations into /app/migrations.
- postgres 3.4.5 added as direct broker dep.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/cli/src/services/telemetry/emit.ts

@@ -0,0 +1,12 @@
+import { isOptedOut } from "./opt-out.js";
+
+export interface TelemetryEvent {
+  event: string;
+  properties?: Record<string, unknown>;
+}
+
+export function emit(event: TelemetryEvent): void {
+  if (isOptedOut()) return;
+  // Pass 1: telemetry is a no-op stub. Events are defined but not sent.
+  // Pass 2 adds PostHog or similar backend.
+}

apps/cli/src/services/telemetry/facade.ts

@@ -0,0 +1,2 @@
+export { emit } from "./emit.js";
+export { isOptedOut, optOut } from "./opt-out.js";

apps/cli/src/services/telemetry/index.ts

@@ -0,0 +1 @@
+export * from "./facade.js";

apps/cli/src/services/telemetry/opt-out.ts

@@ -0,0 +1,17 @@
+import { existsSync, writeFileSync, unlinkSync } from "node:fs";
+import { join } from "node:path";
+import { PATHS } from "~/constants/paths.js";
+
+const OPT_OUT_FILE = join(PATHS.CONFIG_DIR, ".telemetry-opt-out");
+
+export function isOptedOut(): boolean {
+  return process.env.CLAUDEMESH_TELEMETRY === "0" || existsSync(OPT_OUT_FILE);
+}
+
+export function optOut(): void {
+  writeFileSync(OPT_OUT_FILE, "", "utf-8");
+}
+
+export function optIn(): void {
+  try { unlinkSync(OPT_OUT_FILE); } catch {}
+}