#4105 ci(tooling): run pgTAP tests on the local Postgres container

Summary

Runs every pgTAP file in supabase/tests on the local Postgres container from #4102, without the Supabase stack.

• bun run db:test (new subcommand in scripts/local-db.ts): creates pgtap in the extensions schema, then runs each supabase/tests/*.sql file in name order with psql inside the container (ON_ERROR_STOP=1, like pg_prove). A file fails on any not ok, a missing or unmet plan, or a SQL error. It prints one line per file, the failing lines (not ok, # diagnostics, ERROR/DETAIL/HINT/CONTEXT), totals, and exits non-zero on any failure.
• The test_local_db job runs it after the two db:provision steps. The job is renamed Local Postgres provision and pgTAP (no Supabase stack).
• 28_channel_device_counts.sql and 88_test_apps_derived_counter_guard.sql now drain the channel_device_counts queue first (inside their transaction). It assumed the queue was empty, but seed.sql fills it and only a pg_cron tick between the seed and the tests empties it, so right after provisioning the processor calls returned 10 instead of 1 (88 passed only because it runs after the first tick).
• The supabase test db step in test_backend_sql is unchanged: both run side by side until a follow-up removes the old one.
• AGENTS.md: one line for db:test.

No pg_prove: the supabase/postgres image doesn't ship it, and psql plus the plan/ok/not ok check is all this needs.

Test plan

• Unit tests: bunx vitest run tests/local-db.unit.test.ts (pass, not ok, unmet plan, missing plan, SQL error)
• CI Local Postgres provision and pgTAP (no Supabase stack): 110/110 files, 1,484 ok (job)
• supabase test db (Run backend SQL checks) still green, including 28, 46 and 88 (job)
• A deliberately broken test turns the job red: ok(false) in 01_test_dumy.sql gave FAIL 01_test_dumy.sql: 1 not ok, exit 1 (job); reverted in the next commit
• Manual: bun run db:up && bun run db:provision && bun run db:test

Screenshots

Not applicable (tooling only).

Checklist

• My code follows the code style of this project and passes
  bun run lint:backend && bun run lint.
• My change requires a change to the documentation. (AGENTS.md line added)
• I have updated the documentation
  accordingly.
• My change has adequate E2E test coverage.
• I have tested my code manually, and I have provided steps how to reproduce
  my tests
• No GHSA ids, unpublished advisory bodies or PoCs, or embargoed exploit detail in this public PR (title, body, commits, branch name).
• Security-sensitive authz / OTA / SQL / webhook / path changes reviewed against docs/agent-security-regressions.md.

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

Summary by CodeRabbit

• New Features
  • Added a local database test command that runs SQL tests and reports results for each test file, including failures and incomplete test runs.
  • Automated the database tests in the local Postgres workflow after database provisioning.
• Bug Fixes
  • Improved reliability of channel device count tests by clearing pending messages before checking results; the cleanup is rolled back with the test.
• Documentation
  • Added instructions for running local database tests against a provisioned local Postgres database.