feat(broker): migrations-based install, roles, RLS, and job dependency groups

Replace the ad-hoc tables/procedures install layout with versioned,
ordered SQL migrations tracked in broker_schema_migrations. Add
optional least-privilege role provisioning (--with-roles), multi-tenant
row-level security, lease-based job claiming with stale-lease recovery,
and job dependencies -- both by job id and by fan-in job group. Add
Docker/Compose support for running the broker and its test suite.

tests/integration/workflow_test.go

@@ -65,8 +65,8 @@ func TestBrokerWorkflow(t *testing.T) {
 	// Install schema
 	t.Log("Installing database schema...")
 	installer := install.New(dbAdapter, logger)
-	err = installer.InstallSchema(ctx)
-	require.NoError(t, err, "Failed to install schema")
+	err = installer.ApplyMigrations(ctx)
+	require.NoError(t, err, "Failed to apply migrations")
 
 	// Verify installation
 	t.Log("Verifying schema installation...")
@@ -127,7 +127,7 @@ func TestBrokerWorkflow(t *testing.T) {
 	var errmsg string
 	var jobID int64
 	err = db.QueryRowContext(ctx, `
-		SELECT * FROM broker_add_job(
+		SELECT * FROM broker.broker_add_job(
 			$1,  -- job_name
 			$2,  -- execute_str
 			$3,  -- job_queue
@@ -135,7 +135,9 @@ func TestBrokerWorkflow(t *testing.T) {
 			$5,  -- job_language
 			NULL, -- run_as
 			NULL, -- schedule_id
-			NULL  -- depends_on
+			NULL, -- depends_on_job_ids
+			NULL, -- idempotency_key
+			NULL  -- max_attempts
 		)
 	`,
 		"Test Job",
@@ -165,7 +167,7 @@ func TestBrokerWorkflow(t *testing.T) {
 			SELECT id_broker_jobs, job_name, job_priority, job_queue, job_language,
 			       execute_str, execute_result, error_msg, complete_status,
 			       created_at, updated_at
-			FROM broker_jobs
+			FROM broker.broker_jobs
 			WHERE id_broker_jobs = $1
 		`, jobID).Scan(
 			&job.ID,
@@ -243,32 +245,10 @@ func connectWithRetry(connStr string, maxRetries int, retryInterval time.Duratio
 	return nil, err
 }
 
-// cleanupSchema removes all broker tables and functions for a clean test
+// cleanupSchema drops the entire broker schema for a clean test run.
 func cleanupSchema(t *testing.T, db *sql.DB) {
-	tables := []string{"broker_jobs", "broker_queueinstance", "broker_schedule"}
-	procedures := []string{
-		"broker_get",
-		"broker_run",
-		"broker_set",
-		"broker_add_job",
-		"broker_register_instance",
-		"broker_ping_instance",
-		"broker_shutdown_instance",
-	}
-
-	// Drop procedures
-	for _, proc := range procedures {
-		_, err := db.Exec("DROP FUNCTION IF EXISTS " + proc + " CASCADE")
-		if err != nil {
-			t.Logf("Warning: failed to drop procedure %s: %v", proc, err)
-		}
-	}
-
-	// Drop tables
-	for _, table := range tables {
-		_, err := db.Exec("DROP TABLE IF EXISTS " + table + " CASCADE")
-		if err != nil {
-			t.Logf("Warning: failed to drop table %s: %v", table, err)
-		}
+	_, err := db.Exec("DROP SCHEMA IF EXISTS broker CASCADE")
+	if err != nil {
+		t.Logf("Warning: failed to drop broker schema: %v", err)
 	}
 }