feat: add database-postgres driver boundary package (E00-S03-T02)

- packages/database-postgres (@personal-blog/database-postgres): the single
  workspace package allowed to import the PostgreSQL driver — declares pg and
  kysely as exact dependencies (@types/pg for types) and its src/index.ts
  imports and re-exports the driver pieces (Pool, Kysely, PostgresDialect) so
  the isolation is real, not a placeholder
- pnpm-lock.yaml: importer for packages/database-postgres plus the resolved
  pg/kysely dependency tree (frozen-lockfile install keeps working)
- .gitea/workflows/ci.yml: new database-postgres-imports job runs
  tests/database-postgres-imports.test.mjs on every PR so the isolation
  criterion gates merges

.gitea/workflows/ci.yml

@@ -37,6 +37,22 @@ jobs:
       - name: Run secrets-not-embedded test suite
         run: node --test tests/secrets-not-embedded.test.mjs
 
+  # E00-S03-T02: the static assertions of tests/database-postgres-imports.test.mjs
+  # gate every PR — the scan proves pg/Kysely imports live only in
+  # packages/database-postgres and the mutation probes prove the scan catches
+  # a driver import injected into any other package.
+  database-postgres-imports:
+    name: Database-postgres import isolation (E00-S03-T02)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install Node.js 24
+        uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+      - name: Run database-postgres import isolation suite
+        run: node --test tests/database-postgres-imports.test.mjs
+
   # E00-S03-T01: the static assertions of tests/compose-config.test.mjs (db
   # image pinned to postgres:18.6-bookworm, health gate, volume persistence,
   # build platforms) gate every PR (the docker-gated real-stack probes inside