redis, postgres: full nox provider modules — client, tools, provisioner, events

redis provides redis-cache: a real admin client speaking RESP over a raw socket
(node:net, no deps); provisioner makes a keyspace-scoped ACL user per grant.
postgres provides postgres-database: admin client executing through psql (the
consistent shell-out port, like minio's mc), full DDL for create/drop database+
role, a CSV row parser, read-only query tool. Both emit
module.<x>.<thing>.provisioned/.deprovisioned from the provisioner. Both
typecheck; manifests parse.

modules/postgres/tools/index.ts

@@ -0,0 +1,44 @@
+// postgres's tools — postgres's own code (novox/hq ADR 0044), importing postgres's own client. They
+// return structured data; the mesh serves them through the sdk's tool harness. Both call through
+// PostgresClient.query(), the module's one pending execution boundary (see client.ts): the tool
+// shapes are fixed and correct, and surface the TODO honestly until that boundary is backed.
+
+import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
+import { PostgresClient } from "../client.js";
+
+export function getPostgresTools(postgres: PostgresClient): ToolDefinition[] {
+  return [
+    {
+      name: "postgres_list_databases",
+      description: "List the databases on the postgres server, with their on-disk size.",
+      input: {},
+      run: async () => ({ databases: await postgres.listDatabases() }),
+    },
+    {
+      name: "postgres_query",
+      description: "Run a read-only SQL query against a named database (wrapped in a read-only transaction).",
+      input: {
+        database: { type: "string", description: "the database to query" },
+        sql: { type: "string", description: "the SELECT (or other read-only) statement" },
+      },
+      run: async (args) => {
+        const database = String(args.database ?? "");
+        const sql = String(args.sql ?? "");
+        if (!database) throw new Error("postgres_query: database is required");
+        if (!sql) throw new Error("postgres_query: sql is required");
+        const result = await postgres.readOnlyQuery(database, sql);
+        return { database, command: result.command, rows: result.rows };
+      },
+    },
+  ];
+}
+
+// The tools exist only when the server can be reached from the environment; without it, postgres
+// contributes none rather than failing the whole tool runtime.
+registerModuleTools("postgres", (env) => {
+  try {
+    return getPostgresTools(PostgresClient.fromEnv(env));
+  } catch {
+    return [];
+  }
+});