feat(ctl): edgeguard-ctl migrate + initdb wired into postinst

migrate up|down|check|dump (1:1 nmg-ctl-Pattern, ruft internal/database
Migrate/MigrateDown/ValidateMigrations/CopyEmbeddedMigrationsTo).
initdb prüft pg_roles/pg_database und legt Role + DB idempotent via
sudo -u postgres psql an, mit Identifier-Whitelist gegen Injection.
postinst wirt die drei Schritte vor systemd-enable: migrate check
(Pre-Flight ohne DB), initdb, migrate up (als edgeguard-User via
Socket-Peer-Auth). cluster-join/promote/dump-config bleiben explizit
Phase-3-Stubs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packaging/debian/edgeguard-api/DEBIAN/postinst

@@ -1,7 +1,7 @@
 #!/bin/bash
 # postinst for edgeguard-api — creates system user, filesystem layout,
-# enables systemd units. DB init + migrations run lazily on first start
-# of edgeguard-api.
+# initialises PostgreSQL (role + db + migrations), enables systemd
+# units. Each step idempotent; safe to re-run on every upgrade.
 set -e
 
 export LC_ALL=C
@@ -28,6 +28,29 @@ case "$1" in
             install -d -m 0750 -o "$EG_USER" -g "$EG_USER" "$d"
         done
 
+        # ── Pre-flight: validate embedded migration set ──────────────
+        # Catches duplicate version prefixes BEFORE we touch the DB,
+        # so a broken upgrade can't half-apply migrations and leave
+        # the cluster wedged (mail-gateway 2026-05-08 incident).
+        if ! /usr/bin/edgeguard-ctl migrate check; then
+            echo "postinst: embedded migrations failed validation — aborting" >&2
+            exit 1
+        fi
+
+        # ── PostgreSQL: ensure role + database exist ─────────────────
+        # Requires postgresql-16 (or -17) running locally — guaranteed
+        # by Depends. Idempotent — re-runs on upgrade are no-ops.
+        if ! /usr/bin/edgeguard-ctl initdb; then
+            echo "postinst: edgeguard-ctl initdb failed — aborting" >&2
+            exit 1
+        fi
+
+        # ── Apply pending schema migrations ──────────────────────────
+        if ! sudo -n -u "$EG_USER" /usr/bin/edgeguard-ctl migrate up; then
+            echo "postinst: edgeguard-ctl migrate up failed — aborting" >&2
+            exit 1
+        fi
+
         # ── systemd ──────────────────────────────────────────────────
         systemctl daemon-reload
         systemctl enable --now edgeguard-api.service edgeguard-scheduler.service || true