feat: add Postgres store with append-only schema and migrations

internal/store connects via pgx and runs golang-migrate migrations
embedded in the binary (go:embed), so Deklarix stays a single binary
despite the move to Postgres. Schema covers the five MVP tables
(submission, asset, extraction, finding, evidence_package, participant).

extraction, finding and evidence_package are append-only by design: a
Postgres trigger rejects UPDATE/DELETE outright, since a corrigible
evidence archive isn't an evidence archive. Corrections to a finding are
new rows whose supersedes column points at the row they replace (set at
INSERT time on the new row, since the trigger blocks UPDATE on the old
one) — "currently valid" findings are the ones no other row supersedes.

scripts/test.sh now spins up a disposable Postgres container so the
store's integration tests (including the append-only guarantee) actually
run on every test.sh/release.sh invocation instead of silently skipping
for lack of DATABASE_URL.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

internal/store/store_test.go

@@ -0,0 +1,86 @@
+package store_test
+
+import (
+	"context"
+	"os"
+	"testing"
+
+	"github.com/netcell-it/deklarix/internal/store"
+)
+
+// Diese Tests brauchen eine laufende Postgres-Instanz und werden ohne
+// DATABASE_URL übersprungen, statt eine Verbindung vorzutäuschen.
+func testDatabaseURL(t *testing.T) string {
+	t.Helper()
+	url := os.Getenv("DATABASE_URL")
+	if url == "" {
+		t.Skip("DATABASE_URL nicht gesetzt, überspringe Store-Integrationstest")
+	}
+	return url
+}
+
+func TestMigrateAndOpen(t *testing.T) {
+	url := testDatabaseURL(t)
+
+	if err := store.Migrate(url); err != nil {
+		t.Fatalf("Migrate: %v", err)
+	}
+
+	s, err := store.Open(context.Background(), url)
+	if err != nil {
+		t.Fatalf("Open: %v", err)
+	}
+	defer s.Close()
+
+	var tableCount int
+	err = s.Pool.QueryRow(context.Background(), `
+		SELECT count(*) FROM information_schema.tables
+		WHERE table_schema = 'public' AND table_name = ANY($1)
+	`, []string{"submission", "asset", "extraction", "finding", "evidence_package", "participant"}).Scan(&tableCount)
+	if err != nil {
+		t.Fatalf("query tables: %v", err)
+	}
+	if tableCount != 6 {
+		t.Fatalf("expected 6 tables, got %d", tableCount)
+	}
+}
+
+func TestFindingIsAppendOnly(t *testing.T) {
+	url := testDatabaseURL(t)
+
+	if err := store.Migrate(url); err != nil {
+		t.Fatalf("Migrate: %v", err)
+	}
+
+	s, err := store.Open(context.Background(), url)
+	if err != nil {
+		t.Fatalf("Open: %v", err)
+	}
+	defer s.Close()
+
+	ctx := context.Background()
+
+	var submissionID string
+	err = s.Pool.QueryRow(ctx, `
+		INSERT INTO submission (platform, post_type) VALUES ('instagram', 'reel')
+		RETURNING id
+	`).Scan(&submissionID)
+	if err != nil {
+		t.Fatalf("insert submission: %v", err)
+	}
+
+	var findingID string
+	err = s.Pool.QueryRow(ctx, `
+		INSERT INTO finding (submission_id, rule_id, rule_version, severity, message)
+		VALUES ($1, 'WK-004', 3, 'hoch', 'Testfeststellung')
+		RETURNING id
+	`, submissionID).Scan(&findingID)
+	if err != nil {
+		t.Fatalf("insert finding: %v", err)
+	}
+
+	_, err = s.Pool.Exec(ctx, `UPDATE finding SET message = 'geändert' WHERE id = $1`, findingID)
+	if err == nil {
+		t.Fatal("expected UPDATE on finding to be rejected, but it succeeded")
+	}
+}