feat: derive hosted raw captures into PostgreSQL sessions

[salmonumbrella]

Adds opt-in server-side derivation for hosted raw sync. Accepted captures now feed a bounded worker, an isolated Linux parser, and a transactional PostgreSQL projection. Hosted browsing no longer needs a local SQLite archive or pg push to turn raw captures into sessions. Local sync and hosted derivation share the preparation path; the existing artifact wire format stays unchanged.

The hosted store enforces tenant isolation and maps storage IDs to public session IDs. Copies with the same provider identity and content share a session. Curation survives matching copies, conflicting copies remain explicit, and deleting a source removes only its contribution. Publication is transactional; retries and pending-signal maintenance are bounded.

Deployment remains one tenant per server instance, with explicit owner provisioning and a restricted runtime role. Disabling derivation preserves hosted reads. Embedding work is queued durably; its consumer, device-enrollment UI, and broader lifecycle controls remain separate work.

Continues item 4 of #1352 after #1607. Operator setup and limits are in docs/hosted-raw-sync.md and docs/pg-sync.md.

[roborev-ci]

roborev: Combined Review (8081e58)

Verdict: Changes require fixes for 1 finding.

High

• internal/postgres/hosted_legacy_revision.go:34: The hosted legacy alias function calls sha256(bytea), which is unavailable in PostgreSQL 16, causing legacy identity triggers and indexed expressions to fail. Use a PostgreSQL-16-compatible implementation such as pgcrypto.digest(convert_to(...), 'sha256'), provision or verify the extension, and test legacy provisioning and inserts on PostgreSQL 16.

  Reported by: codex

---

Reviewers: 2 done | Synthesis: codex, 9s | Total: 1h43m38s