feat: add Postgres store with append-only schema and migrations

internal/store connects via pgx and runs golang-migrate migrations
embedded in the binary (go:embed), so Deklarix stays a single binary
despite the move to Postgres. Schema covers the five MVP tables
(submission, asset, extraction, finding, evidence_package, participant).

extraction, finding and evidence_package are append-only by design: a
Postgres trigger rejects UPDATE/DELETE outright, since a corrigible
evidence archive isn't an evidence archive. Corrections to a finding are
new rows whose supersedes column points at the row they replace (set at
INSERT time on the new row, since the trigger blocks UPDATE on the old
one) — "currently valid" findings are the ones no other row supersedes.

scripts/test.sh now spins up a disposable Postgres container so the
store's integration tests (including the append-only guarantee) actually
run on every test.sh/release.sh invocation instead of silently skipping
for lack of DATABASE_URL.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/test.sh

@@ -15,6 +15,36 @@ fail() { echo -e "${RED}[FAIL]${NC} $*"; exit 1; }
 
 cd "$REPO_DIR"
 
+# internal/store hat Integrationstests gegen echtes Postgres (u. a. die
+# Append-only-Garantie auf finding/extraction/evidence_package). Ohne
+# DATABASE_URL überspringt Go diese Tests still — das darf im
+# Release-Pfad (release.sh ruft dieses Skript auf) nicht passieren.
+# Deshalb hier immer ein Wegwerf-Postgres hochziehen.
+PG_CONTAINER="deklarix-test-pg-$$"
+PG_PORT=15432
+
+command -v docker >/dev/null 2>&1 || fail "docker wird für die Store-Tests (Postgres) benötigt"
+
+stop_test_db() { docker rm -f "$PG_CONTAINER" >/dev/null 2>&1 || true; }
+trap stop_test_db EXIT
+
+log "Starte Test-Postgres ($PG_CONTAINER) ..."
+docker run -d --name "$PG_CONTAINER" \
+    -e POSTGRES_PASSWORD=test -e POSTGRES_DB=deklarix \
+    -p "${PG_PORT}:5432" postgres:16-alpine >/dev/null
+
+ready=0
+for _ in $(seq 1 30); do
+    if docker exec "$PG_CONTAINER" pg_isready -U postgres >/dev/null 2>&1; then
+        ready=1
+        break
+    fi
+    sleep 1
+done
+[[ "$ready" -eq 1 ]] || fail "Test-Postgres wurde nicht rechtzeitig bereit"
+
+export DATABASE_URL="postgres://postgres:test@localhost:${PG_PORT}/deklarix?sslmode=disable"
+
 log "go vet ..."
 go vet ./... || fail "go vet fehlgeschlagen"