db: postgres layer for repos, ACLs, dolt keys

Store wraps a Querier (*sql.DB/*sql.Tx/*sql.Conn); context-first methods, FromContext for core-go middleware, WithTx for the create-repo transaction. Repo CRUD + listing-visibility rules, effective-access/ACL upsert, dolt_key CRUD with typed ErrNotFound/ErrNameTaken/ErrKeyExists. Tests gated on DOLTSRHT_TEST_PG: per-run scratch schema + schema.sql, CRUD/visibility/effective-access cases; skip when unset.