feat: add direct PostgreSQL and ACK deployment support

tests/postgres-privilege-contract.test.ts

@@ -0,0 +1,14 @@
+import { readFile } from "node:fs/promises";
+import { describe, expect, it } from "vitest";
+
+describe("PostgreSQL application-role privilege contract", () => {
+  it("uses explicit current-object grants and no blanket future-object grants", async () => {
+    const source = await readFile(new URL("../scripts/migrate-postgres.mjs", import.meta.url), "utf8");
+    expect(source).toContain('["billing_wallets", "SELECT, INSERT, UPDATE"]');
+    expect(source).toContain('["billing_ledger", "SELECT, INSERT"]');
+    expect(source).toContain("applicationRoleTablePrivileges().map");
+    expect(source).toContain("REVOKE ALL ON TABLE");
+    expect(source).not.toContain("ALTER DEFAULT PRIVILEGES");
+    expect(source).not.toContain("ALL FUNCTIONS IN SCHEMA");
+  });
+});