#925 Production Postgres on pg-nano with TLS client certs (verify-full); data migration from pg.rodmena.app

EARS SPEC: - Every DB client (engine pool, migretti, psql in entrypoint, resilient-circuit, db tool) shall connect with sslmode=verify-full and client certs. - The health endpoint shall report ssl=true for the API's own connection. - When data is migrated, per-table count(*) shall match exactly between source and target. - Migrations shall run as the DDL-capable role; runtime roles shall have no DDL. Parent epic: #913. Synthesis (technical problems / solution domains / alternatives) recorded as a comment when started.