fix(infra-setup): escape backticks in the closing message; report db verification honestly

The closing heredoc interpolates $EDGE_HOST, so backticks in its prose ran as
command substitution ('create: command not found').

A missing psql on the app host was reported as an authentication failure, which
sends you looking at the CN mapping instead of at a package that has no reason
to be installed. An unreachable standby is now a loud, specific warning: pg_ident
is not replicated, so a failover to a standby that never got the mapping locks
the app out during an outage.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MSDYiibCtELsrjQq6KXnoi

script/infra-setup.sh

@@ -295,7 +295,7 @@ $EDGE_HOST is configured. One step is NOT automated here:
            --hostname blackbeard --domain internal --rr A --server <edge mesh ip>
        done
 
-     `create` only saves; POST /api/unbound/service/reconfigure on each router
+     \`create\` only saves; POST /api/unbound/service/reconfigure on each router
      to apply.
 
 EOF
@@ -441,8 +441,27 @@ REMOTE
 
     info "verifying the mapping from $API_HOST"
     if reachable "$API_HOST"; then
-        ssh "$API_HOST" "sudo -u blackbeard psql 'host=$PG_PRIMARY port=5432 dbname=$DB_NAME user=$DB_ROLE sslmode=verify-full sslrootcert=/etc/pki/ca-trust/source/anchors/root-internal.pem sslcert=/etc/pki/tls/misc/\$(hostname -f).pem sslkey=/etc/pki/tls/private/\$(hostname -f).pem' -tAc 'select current_user'" \
-            || warn "the app host could not authenticate to $PG_PRIMARY — check the CN mapping and the key ACL"
+        # `psql` is not installed on an app host and there is no reason for it
+        # to be, so its absence must not be reported as an authentication
+        # failure — that reads as a broken mapping and sends you looking in the
+        # wrong place. When it is missing, the deploy's own health probe is the
+        # verification: the daemon connects with exactly these credentials.
+        if ssh "$API_HOST" "command -v psql >/dev/null"; then
+            ssh "$API_HOST" "sudo -u blackbeard psql 'host=$PG_PRIMARY port=5432 dbname=$DB_NAME user=$DB_ROLE sslmode=verify-full sslrootcert=/etc/pki/ca-trust/source/anchors/root-internal.pem sslcert=/etc/pki/tls/misc/\$(hostname -f).pem sslkey=/etc/pki/tls/private/\$(hostname -f).pem' -tAc 'select current_user'" \
+                || warn "the app host could not authenticate to $PG_PRIMARY — check the CN mapping and the key ACL"
+        else
+            info "psql absent on $API_HOST; the deploy's health probe verifies the connection instead"
+        fi
+    fi
+
+    # Not a warning to be dismissed. pg_ident.conf contents are NOT replicated,
+    # so a standby that never received this mapping will refuse the app the
+    # moment it is promoted — with an authentication error that looks like a
+    # certificate problem and arrives during an outage.
+    if ! ssh -o ConnectTimeout=8 -o BatchMode=yes "$PG_STANDBY" true 2>/dev/null; then
+        warn "$PG_STANDBY did not receive the pg_ident mapping."
+        warn "Re-run: ./script/infra-setup.sh --role database   once it is reachable."
+        warn "Until then a failover to it will lock blackbeard-api out of the database."
     fi
 }