feat: Add --allow-function-prefix flag for restricted mode

[willfrey]

Summary

• Adds a repeatable --allow-function-prefix CLI flag that lets operators whitelist function prefixes (e.g. st_ for PostGIS) in restricted mode, without opening up all functions
• Default behavior is unchanged — when the flag is not provided, only the existing ALLOWED_FUNCTIONS set is permitted

Motivation

In restricted mode the SQL validator blocks any function not in the built-in allowlist. This makes it impossible to use extensions like PostGIS whose functions (ST_Intersects, ST_DWithin, etc.) are safe read-only calls. Rather than hard-coding every extension's functions, this flag lets operators opt-in by prefix:

postgres-mcp --access-mode restricted --allow-function-prefix st_

Changes

• server.py — new --allow-function-prefix argument (repeatable via action="append"), threaded through to SafeSqlDriver
• safe_sql.py — SafeSqlDriver.__init__ accepts allowed_function_prefixes; validation checks prefixes after the existing allowlist lookup
• tests/unit/sql/test_safe_sql.py — three new tests covering prefix-allowed, prefix-not-set-blocks, and case-insensitive matching

Test plan

• Existing tests pass
• New unit tests cover the feature