feat: add PostgreSQL system of record

[fly1d]

Summary

• add a SQLAlchemy/psycopg PostgreSQL adapter for agents, approvals, and append-only audit events
• add an Alembic initial migration, schema revision readiness checks, and database-level audit mutation protection
• run PostgreSQL and migration integration in CI and provide an ordered PostgreSQL -> migration -> API Compose topology
• retain the in-memory adapter for development when ACP_DATABASE_URL is unset

Risk classification

High. This introduces the first durable system of record and a reversible database migration.

Review focus

• transaction atomicity between state changes and audit writes
• row-locking and optimistic revision behavior under competing writers
• upgrade/downgrade correctness and readiness behavior around schema state
• append-only audit trigger and deployment startup ordering
• synchronous database work remains outside the FastAPI event loop

Evidence

• make check: 32 passed, 1 PostgreSQL integration test skipped without a database; 98.55% coverage
• isolated dependency audit: no known vulnerabilities (the unpublished local package itself is skipped)
• Python 3.11 container image builds and the packaged service becomes healthy
• PostgreSQL 17: alembic upgrade head, alembic check, integration test, alembic downgrade base, and re-upgrade passed
• Compose: state and audit events survived an API container restart
• database trigger rejected audit UPDATE, DELETE, and TRUNCATE
• both postgresql:// and postgresql+psycopg:// URL forms use psycopg 3 successfully

Rollback

1. Stop API writers.
2. Back up the PostgreSQL database before any destructive rollback.
3. Roll the API image back to the previous release.
4. Run alembic downgrade base only for disposable or explicitly approved data removal; the initial downgrade drops all control-plane tables.
5. Restore from the pre-change backup if durable data must be retained.

Remaining risks

• actor identity is supplied by callers and is not authenticated
• write APIs do not yet support idempotency keys
• automated backup/restore and retention policy are not implemented
• production tenant isolation and least-privilege database roles are not implemented

[fly1d]

Final code review completed after all required checks passed.

Findings resolved before submission:

• bare postgresql:// URLs previously selected SQLAlchemy's unavailable psycopg2 default; they now normalize to the installed psycopg 3 driver and have regression plus live-connection coverage
• synchronous PostgreSQL calls previously ran inside async route handlers; store-backed routes are now synchronous so FastAPI executes them in its worker pool

No unresolved blocking findings remain in the submitted diff. The migration is reversible but destructive on downgrade, which is documented in the PR rollback plan. Authentication, idempotency, backups, retention, and tenant isolation remain explicit follow-up risks rather than hidden production claims.