Add test template/clone API (adminUrl + cloneFromTemplate + dispose clones)

[simoncrypta]

Recommendation

Own the migrate-once + TEMPLATE clone pattern in cedar-pg so apps are not permanent “template runners.”

Preferred surface (names flexible):

const ensured = await ensure({ mode: "test", template: true });
// app runs migrations against ensured.databaseUrl once
await markTemplate?.(ensured); // or ensure({ template: true }) after migrate hook

const worker = await cloneFromTemplate({
  // uses admin connection internally
});
// worker.databaseUrl — role credentials, correct password

await dispose({ mode: "test", dropOwnedDatabases: true });

Concrete asks

1. Return adminUrl on EnsureResult — apps currently re-derive postgresql://postgres:postgres@127.0.0.1:<port>/postgres from port for privileged DDL
2. cloneFromTemplate() (or grant CREATEDB on test roles) — test roles are LOGIN only today, so workers cannot CREATE DATABASE … TEMPLATE
3. Dispose must handle templates + clones — unset IS_TEMPLATE before drop; drop other DBs owned by the test role (or dropOwnedDatabases: true / resetTestCluster())

Why this belongs in cedar-pg

LeftLane (and similar Redwood/Prisma Jest setups) need strong per-worker isolation without re-running migrations per worker. Stock @cedarjs/pg/jest (ensure/dispose only) is too thin for that and forces large app glue.

Long-term: app keeps prisma migrate reset once; cedar-pg owns mark-template / clone / GC.

Fallback if cedar-pg will not own templates

Document superuser-only test URLs for clone harnesses (simpler auth, still need clone orchestration somewhere).

Context

Split from #1 after LeftLane alpha review. Goal: shrink app-owned cedarPgProvider before beta.