feat(db): dbctl — reconcile per-peer CONNECT authorization on the shared DB (M2 §4)

New lib/db/dbctl: SyncAuthorization runs after the DB starts (EnsureDatabaseRunning),
ensuring a LOGIN role + CONNECT grant per installed peer and revoking the stock
PUBLIC CONNECT grant on mTLS-armed databases; RevokeForService drops a peer's
CONNECT at uninstall. Admin executes over the in-container unix socket as
postgres (trust). Wired into ensureInfraRunning and UninstallContainer.
Includes unit tests + env-gated live integration test.

src/lib/containers/infra.go

@@ -20,6 +20,7 @@ import (
 	"fmt"
 	"strings"
 
+	"git.dcntrlized.org/Dcntrlized/Maestro/lib/db"
 	"git.dcntrlized.org/Dcntrlized/Maestro/lib/docker"
 	"git.dcntrlized.org/Dcntrlized/Maestro/lib/logger"
 	libregistry "git.dcntrlized.org/Dcntrlized/Maestro/lib/registry"
@@ -104,6 +105,16 @@ func ensureInfraRunning(ctx context.Context, serviceName, label string) error {
 	if err := StartContainer(ctx, types.RegistryContainer{Name: serviceName}); err != nil {
 		return fmt.Errorf("failed to start %s %s: %w", label, serviceName, err)
 	}
+
+	// For the shared database, reconcile the CONNECT authorization against the
+	// peers Maestro manages (M2 §4): per-role CONNECT grants and, in mTLS mode,
+	// PUBLIC revoked. Best-effort — the database advertises infra-relevant
+	// problems as warnings, never as boot failures.
+	if serviceName == DatabaseServiceName {
+		if err := dbctl.New(dc).SyncAuthorization(ctx); err != nil {
+			logger.Warn("Shared database authorization sync failed: %v", err)
+		}
+	}
 	return nil
 }