chore(asset): add postgres bootstrap and pg_ident template

Idempotent SQL for role and database creation, split between the
postgres-database scope (bootstrap.sql) and the moments-database
scope (bootstrap-moments.sql), since CREATE DATABASE can't run
inside a DO block or transaction.

Roles:
  moments_rw — owner of the moments database; runs migrations
               and writes events from moments-worker.
  moments_ro — read-only; consumed by moments-api.

The pg_ident template is rendered per-host by deploy.sh once it
lands; one (host, role) mapping per file. Reload required on both
magrathea and frankie after install — pg_ident is not replicated.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

asset/sql/bootstrap.sql

@@ -0,0 +1,26 @@
+-- moments role and database bootstrap.
+-- Run as a postgres superuser against the cluster's `postgres` database.
+-- Idempotent — safe to re-run on every deploy.
+--
+--   psql -h magrathea.kosherinata.internal -U postgres -d postgres \
+--        -f asset/sql/bootstrap.sql
+--
+-- After this completes, run asset/sql/bootstrap-moments.sql against the
+-- newly created `moments` database to apply the in-database grants.
+
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'moments_rw') THEN
+    CREATE ROLE moments_rw LOGIN;
+  END IF;
+  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'moments_ro') THEN
+    CREATE ROLE moments_ro LOGIN;
+  END IF;
+END
+$$;
+
+SELECT 'CREATE DATABASE moments OWNER moments_rw'
+WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = 'moments')
+\gexec
+
+GRANT CONNECT ON DATABASE moments TO moments_ro, moments_rw;