roles phase 3: dev tools are a row, not a hardcoded name

rolePermitsDevTools() was `role === 'Developer'` — one line gating two real
grants, a Postgres login role with CREATEDB and a rootless Docker daemon. A role
the owner created at runtime could never have either, which defeats the point of
roles being data.

Two boolean columns on `roles` now carry it, and roleDevGrants() reads the row.
A role that no longer exists reads as neither grant, matching "absence denies"
everywhere else.

NOT the `provisioningScript` D8 asked for, and that column is removed rather
than left dead. A shell script stored on a role row and run at provisioning time
is arbitrary root-level code in a database column, and D8's own warning says why
that is worse than it looks: `usermod -aG docker` is root by a longer route. So
the row CHOOSES from a vocabulary the platform already knows how to carry out —
the same shape as `multiarch` on a plugin's osDependencies, for the same reason.

The seed re-asserts both flags on every run for system roles, and only for them.
Without that, existing rows take the column default of false the moment it lands
and Developer silently loses its tools on the next deploy — every host already
has these four rows, so an insert-only seed would have shipped that. `description`
stays insert-only, because an edit made on one server must survive a deploy.

`db:push` could not apply this and said nothing. Dropping a column while adding
another makes drizzle-kit ask whether it is a rename; with no terminal it bails
and the wrapper still exits 0, leaving the seed to fail against an unchanged
schema. Recorded in src/databases/CLAUDE.md with the SQL, because it will hit
every host on the next deploy and no agent driving a rollout has a terminal.

Verified here: SQL applied guarded, Developer keeps both grants and no other role
gained any, second push emits zero DDL and no prompt, 1423 pass / 0 fail.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Officer-Session: 656f5c85-e49a-4f1f-b9f3-042a04b4d043

src/servers/api/users/provision-os.ts

@@ -5,7 +5,7 @@ import { checkOsAccount } from '@@/os-user-verify';
 import { provisionSshAccess } from '@@/os-user-ssh';
 import { seedShellConfig } from '@@/os-user-shell';
 import { provisionClaudeCli } from '@@/os-user-claude';
-import { provisionPostgresRole, rolePermitsDevTools } from '@@/os-user-postgres';
+import { provisionPostgresRole, roleDevGrants } from '@@/os-user-postgres';
 import { provisionRootlessDocker } from '@@/os-user-docker';
 import { provisionUserDirs } from '@@/data-path';
 
@@ -42,7 +42,7 @@ export async function provisionOsAccount(params: {
   userId: number;
   email: string;
   username: string;
-  /** Decides whether they get a Postgres role. See `rolePermitsDevTools`. */
+  /** Decides whether they get a Postgres role and/or a Docker daemon. See `roleDevGrants`. */
   role: UserRole;
   /** Inbound SSH key for `authorized_keys`. Already validated by the caller. */
   inboundKey?: string | null;
@@ -92,10 +92,14 @@ export async function provisionOsAccount(params: {
   // cannot do it for them and must not try, because the alternative is lending them the owner's credential.
   const claude = await provisionClaudeCli({ email: params.email, osUser: account.osUser });
 
-  // A Postgres login role of the same name, with CREATEDB — for a Developer, and nobody else. What
-  // replaced rootless Docker for the "let me run a database to develop against" case, and it inherits
-  // that feature's role gate along with its purpose: `rolePermitsDevTools` is the one place that rule is
-  // written down.
+  // One read of the role row for both gates below, rather than one query per tool — `roleDevGrants`
+  // returns both flags together for exactly this caller.
+  const devGrants = await roleDevGrants(params.role);
+
+  // A Postgres login role of the same name, with CREATEDB — gated on `grantsPostgres`. What replaced
+  // rootless Docker for the "let me run a database to develop against" case, and it inherits that
+  // feature's role gate along with its purpose: `roleDevGrants` is the one place that rule is written
+  // down, now as a row on the role rather than a name tested in code.
   //
   // Also the step that shuts PUBLIC out of the platform's own database — deliberately inside the function
   // that creates the role rather than in the setup script, so it cannot be skipped by an install that was
@@ -103,7 +107,7 @@ export async function provisionOsAccount(params: {
   //
   // Null, not a skipped-but-ok result: "there is no database role because of who they are" and "the
   // database role worked" are different answers and the caller reports them differently.
-  const postgres = rolePermitsDevTools(params.role)
+  const postgres = devGrants.grantsPostgres
     ? await provisionPostgresRole({
         email: params.email,
         osUser: account.osUser,
@@ -112,14 +116,14 @@ export async function provisionOsAccount(params: {
       })
     : null;
 
-  // Their own rootless Docker daemon — for a Developer, and nobody else. Last, and the most tolerant of
-  // failure: a host without the uidmap package or a kernel that will not do rootless still gets a perfectly
-  // good account, minus containers.
+  // Their own rootless Docker daemon — gated on `grantsDocker`. Last, and the most tolerant of failure: a
+  // host without the uidmap package or a kernel that will not do rootless still gets a perfectly good
+  // account, minus containers.
   //
   // Behind the role gate rather than unconditional. The cost is real and it is per member, not per install:
   // one daemon, one image cache and one subuid range each — see os-user-docker.ts. That is worth paying for
   // someone whose job is to build things here, and not for an account that just reads its dashboards.
-  const docker = rolePermitsDevTools(params.role)
+  const docker = devGrants.grantsDocker
     ? await provisionRootlessDocker({
         osUser: account.osUser,
         uid: account.uid,