feat(broker): migrations-based install, roles, RLS, and job dependency groups

Replace the ad-hoc tables/procedures install layout with versioned,
ordered SQL migrations tracked in broker_schema_migrations. Add
optional least-privilege role provisioning (--with-roles), multi-tenant
row-level security, lease-based job claiming with stale-lease recovery,
and job dependencies -- both by job id and by fan-in job group. Add
Docker/Compose support for running the broker and its test suite.

broker.docker.example.yaml

@@ -0,0 +1,33 @@
+# Config for the docker-compose.yml stack. Copy to broker.docker.yaml
+# (already gitignored), fill in a real password, and it is mounted
+# read-only into the broker/migrate containers at
+# /etc/pgsql-broker/broker.yaml.
+
+databases:
+  - name: primary
+    host: postgres
+    port: 5432
+    database: broker
+    user: broker_runtime
+    password: change_me
+    sslmode: disable
+    max_open_conns: 25
+    max_idle_conns: 5
+    conn_max_lifetime: 5m
+    conn_max_idle_time: 10m
+    queue_count: 4
+
+broker:
+  name: pgsql-broker
+  fetch_query_que_size: 100
+  queue_timer_sec: 10
+  queue_buffer_size: 50
+  worker_idle_timeout_sec: 10
+  notify_retry_seconds: 30s
+  enable_debug: false
+  lease_seconds: 60
+  stale_job_recovery_sec: 30
+
+logging:
+  level: info
+  format: json