feat: provision shared database as hidden infrastructure

The shared dcntrlized-db Postgres service is now treated as Maestro
infrastructure: it is hidden from the service grid and auto-started
before any app container when already installed.

- Container model gains role/hidden/capabilities; registry items gain
  hidden; installed metadata persists manifest capabilities so stopped
  services still surface them.
- Registry marks the shared database image as hidden (OCI annotation,
  label, or name fallback).
- Compose label rewrite merges existing service labels instead of
  replacing them, so org.dcntrlized.role/hidden survive.
- New infra helpers ensure the external dcntrlized_net network and
  start the database on the prod path and before each StartContainer.
- Watcher skips manifest fetch for db-role containers and persists
  capabilities from the manifest.
- spec.yaml documents the new fields.

src/main.go

@@ -55,6 +55,13 @@ func main() {
 		if err := cache.LoadInstalledContainers(); err != nil {
 			log.Fatalf("Failed to load installed containers: %v", err)
 		}
+		// Ensure the shared database is running before reconciling, so its
+		// container is picked up by the reconciliation below. Failures to start
+		// the database are not fatal: Maestro keeps running and the UI surfaces
+		// the database status for manual action.
+		if err := libcontainers.EnsureDatabaseRunning(ctx); err != nil {
+			log.Printf("Warning: failed to ensure shared database: %v", err)
+		}
 		cache.ReconcileContainers(ctx, dc)
 		go cache.WatchContainers(ctx, dc)
 	}