refactor: rename cli-v2 → cli, archive legacy cli, plus broker-side grants + auto-migrate

- apps/cli/ is now the canonical CLI (was apps/cli-v2/).
- apps/cli/ legacy v0 archived as branch 'legacy-cli-archive' and tag
  'cli-v0-legacy-final' before deletion; git history preserves it too.
- .github/workflows/release-cli.yml paths updated.
- pnpm-lock.yaml regenerated.

Broker-side peer-grant enforcement (spec: 2026-04-15-per-peer-capabilities):
- 0020_peer-grants.sql adds peer_grants jsonb + GIN index on mesh.member.
- handleSend in broker fetches recipient grant maps once per send, drops
  messages silently when sender lacks the required capability.
- POST /cli/mesh/:slug/grants to update from CLI; broker_messages_dropped_by_grant_total metric.
- CLI grant/revoke/block now mirror to broker via syncToBroker.

Auto-migrate on broker startup:
- apps/broker/src/migrate.ts runs drizzle migrate with pg_advisory_lock
  before the HTTP server binds. Exits non-zero on failure so Coolify
  healthcheck fails closed.
- Dockerfile copies packages/db/migrations into /app/migrations.
- postgres 3.4.5 added as direct broker dep.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

pnpm-lock.yaml

@@ -130,7 +130,7 @@ importers:
         version: link:../../packages/shared
       drizzle-orm:
         specifier: 0.44.7
-        version: 0.44.7(@libsql/client@0.14.0)(@opentelemetry/api@1.9.0)(@types/pg@8.16.0)(better-sqlite3@12.4.1)(bun-types@1.3.12)(kysely@0.28.5)(pg@8.16.3)(postgres@3.4.7)
+        version: 0.44.7(@libsql/client@0.14.0)(@opentelemetry/api@1.9.0)(@types/pg@8.16.0)(better-sqlite3@12.4.1)(bun-types@1.3.12)(kysely@0.28.5)(pg@8.16.3)(postgres@3.4.5)
       grammy:
         specifier: ^1.35.0
         version: 1.42.0(encoding@0.1.13)
@@ -143,6 +143,9 @@ importers:
       neo4j-driver:
         specifier: 6.0.1
         version: 6.0.1
+      postgres:
+        specifier: 3.4.5
+        version: 3.4.5
       react:
         specifier: 19.2.0
         version: 19.2.0
@@ -194,55 +197,6 @@ importers:
         version: 4.0.14(@opentelemetry/api@1.9.0)(@types/node@24.0.13)(@vitest/ui@4.0.14)(happy-dom@20.8.9)(jiti@2.6.1)(jsdom@26.0.0)(lightningcss@1.30.2)(sass@1.77.4)(terser@5.43.1)(tsx@4.21.0)(yaml@2.8.0)
 
   apps/cli:
-    dependencies:
-      '@modelcontextprotocol/sdk':
-        specifier: 1.27.1
-        version: 1.27.1(zod@4.1.13)
-      citty:
-        specifier: 0.2.2
-        version: 0.2.2
-      libsodium-wrappers:
-        specifier: 0.7.15
-        version: 0.7.15
-      ws:
-        specifier: 8.20.0
-        version: 8.20.0
-      zod:
-        specifier: 4.1.13
-        version: 4.1.13
-    devDependencies:
-      '@turbostarter/eslint-config':
-        specifier: workspace:*
-        version: link:../../tooling/eslint
-      '@turbostarter/prettier-config':
-        specifier: workspace:*
-        version: link:../../tooling/prettier
-      '@turbostarter/tsconfig':
-        specifier: workspace:*
-        version: link:../../tooling/typescript
-      '@turbostarter/vitest-config':
-        specifier: workspace:*
-        version: link:../../tooling/vitest
-      '@types/libsodium-wrappers':
-        specifier: 0.7.14
-        version: 0.7.14
-      '@types/ws':
-        specifier: 8.5.13
-        version: 8.5.13
-      eslint:
-        specifier: 'catalog:'
-        version: 9.39.0(jiti@2.6.1)
-      prettier:
-        specifier: 'catalog:'
-        version: 3.6.2
-      typescript:
-        specifier: 'catalog:'
-        version: 5.9.3
-      vitest:
-        specifier: 'catalog:'
-        version: 4.0.14(@opentelemetry/api@1.9.0)(@types/node@24.0.13)(@vitest/ui@4.0.14)(happy-dom@20.8.9)(jiti@2.6.1)(jsdom@26.0.0)(lightningcss@1.30.2)(sass@1.77.4)(terser@5.43.1)(tsx@4.21.0)(yaml@2.8.0)
-
-  apps/cli-v2:
     dependencies:
       '@modelcontextprotocol/sdk':
         specifier: 1.27.1
@@ -12297,6 +12251,10 @@ packages:
   postgres-range@1.1.4:
     resolution: {integrity: sha512-i/hbxIE9803Alj/6ytL7UHQxRvZkI9O4Sy+J3HGc4F4oo/2eQAjTSNJ0bfxyse3bH0nuVesCk+3IRLaMtG3H6w==}
 
+  postgres@3.4.5:
+    resolution: {integrity: sha512-cDWgoah1Gez9rN3H4165peY9qfpEo+SA61oQv65O3cRUE1pOEoJWwddwcqKE8XZYjbblOJlYDlLV4h67HrEVDg==}
+    engines: {node: '>=12'}
+
   postgres@3.4.7:
     resolution: {integrity: sha512-Jtc2612XINuBjIl/QTWsV5UvE8UHuNblcO3vVADSrKsrc6RqGX6lOW1cEo3CM2v0XG4Nat8nI+YM7/f26VxXLw==}
     engines: {node: '>=12'}
@@ -24601,6 +24559,17 @@ snapshots:
       pg: 8.16.3
       postgres: 3.4.7
 
+  drizzle-orm@0.44.7(@libsql/client@0.14.0)(@opentelemetry/api@1.9.0)(@types/pg@8.16.0)(better-sqlite3@12.4.1)(bun-types@1.3.12)(kysely@0.28.5)(pg@8.16.3)(postgres@3.4.5):
+    optionalDependencies:
+      '@libsql/client': 0.14.0
+      '@opentelemetry/api': 1.9.0
+      '@types/pg': 8.16.0
+      better-sqlite3: 12.4.1
+      bun-types: 1.3.12
+      kysely: 0.28.5
+      pg: 8.16.3
+      postgres: 3.4.5
+
   drizzle-orm@0.44.7(@libsql/client@0.14.0)(@opentelemetry/api@1.9.0)(@types/pg@8.16.0)(better-sqlite3@12.4.1)(bun-types@1.3.12)(kysely@0.28.5)(pg@8.16.3)(postgres@3.4.7):
     optionalDependencies:
       '@libsql/client': 0.14.0
@@ -28834,6 +28803,8 @@ snapshots:
 
   postgres-range@1.1.4: {}
 
+  postgres@3.4.5: {}
+
   postgres@3.4.7: {}
 
   posthog-js@1.283.0: