refactor: rename cli-v2 → cli, archive legacy cli, plus broker-side grants + auto-migrate

- apps/cli/ is now the canonical CLI (was apps/cli-v2/).
- apps/cli/ legacy v0 archived as branch 'legacy-cli-archive' and tag
  'cli-v0-legacy-final' before deletion; git history preserves it too.
- .github/workflows/release-cli.yml paths updated.
- pnpm-lock.yaml regenerated.

Broker-side peer-grant enforcement (spec: 2026-04-15-per-peer-capabilities):
- 0020_peer-grants.sql adds peer_grants jsonb + GIN index on mesh.member.
- handleSend in broker fetches recipient grant maps once per send, drops
  messages silently when sender lacks the required capability.
- POST /cli/mesh/:slug/grants to update from CLI; broker_messages_dropped_by_grant_total metric.
- CLI grant/revoke/block now mirror to broker via syncToBroker.

Auto-migrate on broker startup:
- apps/broker/src/migrate.ts runs drizzle migrate with pg_advisory_lock
  before the HTTP server binds. Exits non-zero on failure so Coolify
  healthcheck fails closed.
- Dockerfile copies packages/db/migrations into /app/migrations.
- postgres 3.4.5 added as direct broker dep.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/cli/tests/golden/version.test.ts

@@ -0,0 +1,12 @@
+import { describe, it, expect } from "vitest";
+import { execSync } from "node:child_process";
+import { resolve } from "node:path";
+
+const CLI = resolve(__dirname, "../../dist/entrypoints/cli.js");
+
+describe("golden: --version", () => {
+  it("outputs version string", () => {
+    const output = execSync(`node ${CLI} --version`, { encoding: "utf-8" }).trim();
+    expect(output).toMatch(/claudemesh v\d+\.\d+\.\d+/);
+  });
+});

apps/cli/tests/golden/whoami.test.ts

@@ -0,0 +1,15 @@
+import { describe, it, expect } from "vitest";
+import { execSync } from "node:child_process";
+import { resolve } from "node:path";
+
+const CLI = resolve(__dirname, "../../dist/entrypoints/cli.js");
+
+describe("golden: whoami --json", () => {
+  it("outputs schema_version 1.0 when not signed in", () => {
+    const env = { ...process.env, CLAUDEMESH_CONFIG_DIR: "/tmp/claudemesh-golden-test-" + Date.now() };
+    const output = execSync(`node ${CLI} whoami --json`, { encoding: "utf-8", env }).trim();
+    const json = JSON.parse(output);
+    expect(json.schema_version).toBe("1.0");
+    expect(json.signed_in).toBe(false);
+  });
+});