ci: run the suite and the migration chain against real Postgres #436

Why

Unit and integration tests run on the mock database. The conformance workflow exercises a fresh install, but nothing tests upgrading from the previous release's schema, and the audit hash chain triggers and raw SQL services never run in this repo's CI.

What

• A CI job with a Postgres service that runs the suite with TEST_DB=postgres
• A job that installs the previous release's schema, seeds data, runs the current migrations and checks the data survives
• Runs on PRs touching src/migrations, src/models or raw SQL services, and nightly

Done when

An upgrade that breaks existing data fails CI before it ships.