fix: enable production PostgreSQL persistence

[franciscojavierarceo]

Summary

• make the existing persistence layer work with PostgreSQL by using portable SQL, configurable pool/timeouts, and per-conversation row locking
• preserve existing PostgreSQL data during the required INTEGER to BIGINT compatibility upgrade, while supporting read-only supervisor-managed schema validation
• fail stored requests explicitly when persistence fails, add PostgreSQL integration coverage and CI, and document production rollout and TLS guidance

This is the PostgreSQL persistence slice of #102.

Closes #103.
Refs #102.

Test Plan

• cargo fmt -- --check
• cargo clippy --all-targets -- -D warnings
• cargo test
• uvx pre-commit run --all-files
• TEST_POSTGRES_URL=... cargo test -p agentic-server-core --lib postgres_integer_widening_upgrade_preserves_existing_state -- --ignored --nocapture
• TEST_POSTGRES_URL=... cargo test -p agentic-server-core --test postgres_storage_integration -- --ignored --nocapture
• uv run --with-requirements docs/requirements.txt mkdocs build --strict (reaches the pre-existing broken docs/design/claude-code-integration.md link to ROADMAP.md)

[franciscojavierarceo]

this works for both postgres and sqlite, postgres rejects "?"

[maralbahari]

Thanks for the work. I left some inline comments

[maralbahari]

nit: this line is too long, can import on top of the file use crate::executor::error{ExecutorError}

[maralbahari]

Parse the database URL once instead of detecting backends with starts_with.
SQLx parses the URL through url::Url, which normalizes URI schemes, while these checks are case-sensitive. A valid POSTGRESQL://... connection succeeds but bypasses every POSTGRES_* setting and after_connect, leaving statement and lock timeouts unset. SQLite has the same classification problem. The redactor also misses case variants. Introduce a validated DatabaseBackend parsed from Url::scheme() and reuse it for configuration, pool construction, diagnostics, and redaction.

[maralbahari]

Converting MigrateError to error.to_string() and wrapping it as sqlx::Error::Configuration discards the source chain and means the new sqlx::Error::Migrate classification can never handle actual migrator failures. Preserve it with sqlx::Error::Migrate(Box::new(error)), or use a project error variant with #[source]