#5 fix(db): grant app user permissions on players and games tables

## Summary Fixes the "permission denied for table players" error found during live verification of PR #4. **Root cause:** PostgreSQL 15+ revokes `CREATE` from non-superusers in the public schema by default. Child 1's `000-init-scores.ts` migration ran as the `postgres` superuser (via `PROVISION_USER`), which in this setup is `postgres` itself — so the tables were created owned by `postgres`. The app user `txt_game_scores` was never granted any privileges, causing every DB operation in production to fail with `permission denied`. **Fix:** Adds `migrations/provision/postgres/001-grant-permissions.ts` which grants `SELECT, INSERT, UPDATE` on `players` and `games`, plus `USAGE, SELECT` on `games_id_seq`, to the app user (`PROVISION_DATABASE = txt_game_scores`). - `000-init-scores.ts` is left **unchanged** (frozen baseline — immutable once deployed) - `migrations/package.json` already exists from PR #3 — no changes needed - App user name is derived from `PROVISION_DATABASE` (HAL postgres provisioner convention: user = database name) ## Test plan - [ ] Pipeline runs `001-grant-permissions.ts` on ace; logs show `[txt-game migration-001] permissions granted to txt_game_scores` - [ ] `docker logs txt-game` no longer shows `permission denied for table players` - [ ] In fresh incognito: win a game, lose a game → "Your best" shows 2 played, 1 won, 1 lost, correct best_attempts, streak = 0, best_streak = 1 - [ ] Scoreboard shows pid prefix + best_attempts row - [ ] `docker_restart txt-game` on ace → reload same incognito window → values identical (persistence verified) **Task:** d1c49d59-57bd-4eba-9e22-f25a04157ad4 **Fixes:** live-verification failure from PR #4