feat(broker): migrations-based install, roles, RLS, and job dependency groups

Replace the ad-hoc tables/procedures install layout with versioned,
ordered SQL migrations tracked in broker_schema_migrations. Add
optional least-privilege role provisioning (--with-roles), multi-tenant
row-level security, lease-based job claiming with stale-lease recovery,
and job dependencies -- both by job id and by fan-in job group. Add
Docker/Compose support for running the broker and its test suite.

pkg/broker/config/config.go

@@ -29,6 +29,15 @@ type DatabaseConfig struct {
 	ConnMaxLifetime time.Duration `mapstructure:"conn_max_lifetime"`
 	ConnMaxIdleTime time.Duration `mapstructure:"conn_max_idle_time"`
 	QueueCount      int           `mapstructure:"queue_count"`
+	// TenantID is the RLS tenant this instance's own workers operate as
+	// (via broker_set_tenant) when claiming/running jobs. Defaults to
+	// "default" so single-tenant deployments are unaffected.
+	TenantID string `mapstructure:"tenant_id"`
+	// AutoMigrate, when true, applies any pending embedded migrations on
+	// connect during normal `start`. When false (default), startup fails
+	// fast if the schema is behind, naming the missing migrations and
+	// pointing at `pgsql-broker install`.
+	AutoMigrate bool `mapstructure:"auto_migrate"`
 }
 
 // BrokerConfig holds broker-specific settings
@@ -40,6 +49,11 @@ type BrokerConfig struct {
 	WorkerIdleTimeoutSec int           `mapstructure:"worker_idle_timeout_sec"`
 	NotifyRetrySeconds   time.Duration `mapstructure:"notify_retry_seconds"`
 	EnableDebug          bool          `mapstructure:"enable_debug"`
+	// LeaseSeconds is how long a claimed job's lease is valid for before
+	// broker_recover_stale_jobs considers it abandoned.
+	LeaseSeconds int `mapstructure:"lease_seconds"`
+	// StaleJobRecoverySec is the interval between broker_recover_stale_jobs sweeps.
+	StaleJobRecoverySec int `mapstructure:"stale_job_recovery_sec"`
 }
 
 // LoggingConfig holds logging settings
@@ -103,6 +117,8 @@ func setDefaults(v *viper.Viper) {
 	v.SetDefault("broker.worker_idle_timeout_sec", 10)
 	v.SetDefault("broker.notify_retry_seconds", 30*time.Second)
 	v.SetDefault("broker.enable_debug", false)
+	v.SetDefault("broker.lease_seconds", 60)
+	v.SetDefault("broker.stale_job_recovery_sec", 30)
 
 	// Logging defaults
 	v.SetDefault("logging.level", "info")
@@ -160,6 +176,9 @@ func applyDatabaseDefaults(config *Config) {
 		if db.QueueCount == 0 {
 			db.QueueCount = 4
 		}
+		if db.TenantID == "" {
+			db.TenantID = "default"
+		}
 	}
 }