feat: provision shared database as hidden infrastructure

The shared dcntrlized-db Postgres service is now treated as Maestro
infrastructure: it is hidden from the service grid and auto-started
before any app container when already installed.

- Container model gains role/hidden/capabilities; registry items gain
  hidden; installed metadata persists manifest capabilities so stopped
  services still surface them.
- Registry marks the shared database image as hidden (OCI annotation,
  label, or name fallback).
- Compose label rewrite merges existing service labels instead of
  replacing them, so org.dcntrlized.role/hidden survive.
- New infra helpers ensure the external dcntrlized_net network and
  start the database on the prod path and before each StartContainer.
- Watcher skips manifest fetch for db-role containers and persists
  capabilities from the manifest.
- spec.yaml documents the new fields.

src/lib/containers/start.go

@@ -42,6 +42,18 @@ func StartContainer(ctx context.Context, item types.RegistryContainer) error {
 		return err
 	}
 
+	// Infrastructure first: the external dcntrlized_net network must exist
+	// before any compose project is started, and services that depend on the
+	// shared database need it running before they boot.
+	if err := EnsureDCNTRLIZEDNetwork(ctx, dc); err != nil {
+		return err
+	}
+	if serviceName != DatabaseServiceName {
+		if err := EnsureDatabaseRunning(ctx); err != nil {
+			logger.Warn("Failed to ensure shared database before starting %s: %v", serviceName, err)
+		}
+	}
+
 	// The compose file may reference the image by a short name (e.g.
 	// "testservice") while install pulled it under its full registry reference.
 	// Make sure those short names exist so Up() can find them.