wip(rls): ScopedDB + rls package + schema policies + echo bridge [pin compiling state]

Phase 3 of the RLS plan, pinned mid-flight because a parallel writer
was actively editing cmd/server/tests/rls_visibility_test.go (A14):
the file flip-flopped between two implementations and gained a compile
error after the previous commit. This snapshot makes the whole tree
compile; functional verification (two-boot gate, invariant green,
full suite) lands in the next commit(s).

- internal/rls: typed ctx keys — user identity (bridged from echo by
  the router) and an INTERNAL marker whose semantics grant nothing:
  no GUC is declared, so policy'd tables still raise at the engine;
  only RLS-ungoverned tables (system_settings, users counts) work for
  user-less startup paths (settings registry Load, CountAdmins).
- internal/database/scoped.go: DBTX decorator — per-statement tx,
  commit-on-Close (:many) / commit-on-Scan (:one), error paths always
  terminate the tx, refusal before SQL when no identity and not
  internal.
- database/schema/schema.sql: idempotent policy block (DROP IF EXISTS
  + CREATE — schema.sql re-runs every boot): ENABLE + FORCE, read
  policy exactly mirroring COALESCE(is_visible,true), permissive
  per-command write stand-ins (FOR ALL would OR into SELECT).
- router.go: RLS bridge at BOTH c.Set("user") sites (JWT + device
  auth) — echo-local storage never reaches the stdlib ctx.
- main.go + test harness: database.New over ScopedDB at both wiring
  sites; startup reads use rls.WithInternal.

cmd/server/tests/rls_visibility_test.go

@@ -1,6 +1,6 @@
-package tests
+package main
 
-// TestRlsInvariant — the PERMANENT black-box auditor for per-user
+// rls_visibility_test.go — the PERMANENT black-box auditor for per-user
 // library visibility (the "family lens").
 //
 // The one sentence it asserts, in the user's language:
@@ -93,11 +93,12 @@ func TestRlsInvariant(t *testing.T) {
 
 	// Hide libH from the REGULAR user — the same row the admin
 	// visibility UI writes (harness idiom: SetLibraryVisibility).
-	require.NoError(t, setup.DB.SetLibraryVisibility(ctx, database.SetLibraryVisibilityParams{
+	_, err := setup.DB.SetLibraryVisibility(ctx, database.SetLibraryVisibilityParams{
 		UserID:    pgtype.UUID{Bytes: [16]byte(regularID), Valid: true},
 		LibraryID: libH.ID,
 		IsVisible: false,
-	}), "hide libH from regular user")
+	})
+	require.NoError(t, err, "hide libH from regular user")
 
 	// OPDS device owned by the REGULAR user (OPDS identity = device owner).
 	opdsToken := "dev_" + uuid.New().String()