feat: add uuidv7 to SQL expression validator, remove pgpm-uuid references

[pyramation]

Summary

Companion PR to constructive-db#589 (PG18 uuidv7() migration). Updates the constructive repo to:

1. Allow uuidv7() in SQL DEFAULT expressions — adds 'uuidv7' to DEFAULT_ALLOWED_FUNCTIONS in the SQL expression validator so fields with DEFAULT uuidv7() pass validation.
2. Remove pgpm-uuid from required extensions — exported migrations no longer list pgpm-uuid as a dependency since the custom UUID module has been removed from constructive-db.
3. Remove pgpm-uuid from module map — PGPM_MODULE_MAP no longer maps pgpm-uuid to @pgpm/uuid, so pgpm install won't attempt to install the removed package.
4. Upgrade docker-compose to PG18 (public image) — docker-compose.yml now uses docker.io/constructiveio/postgres-plus:18 (publicly accessible) instead of ghcr.io/.../postgres-plus:17. The public image is appropriate here since docker-compose is for local development, not CI.

Test fixtures in __fixtures__/sqitch/simple-w-exts/ still reference pgpm-uuid — this is intentional as they represent realistic installed-extension scenarios for module resolution tests.

Review & Testing Checklist for Human

• Deployment ordering: This PR and the dashboard PR should be deployed after constructive-db#589 is merged and PG18 is live. Deploying against a pre-PG18 database where uuidv7() doesn't exist will cause field creation to fail at INSERT time.
• Verify no other code paths depend on pgpm-uuid being in PGPM_MODULE_MAP or DB_REQUIRED_EXTENSIONS — grep for pgpm-uuid outside of __fixtures__/ and confirm nothing else references it.
• Run pnpm test in graphile/graphile-sql-expression-validator to confirm all tests pass with the updated allowlist (now 10 functions).
• Verify docker.io/constructiveio/postgres-plus:18 is pullable — run docker pull docker.io/constructiveio/postgres-plus:18 locally to confirm the public image exists.

Notes

• uuid_generate_v4 and gen_random_uuid are intentionally kept in the allowlist for backward compatibility with existing field definitions.
• The __fixtures__ references to pgpm-uuid test the module resolution logic and are independent of whether the module is actually used in production.
• CI workflows use ghcr.io/constructive-io/docker/postgres-plus:18 (requires GitHub keys); docker-compose.yml uses the public docker.io mirror for local dev without authentication.

Link to Devin session: https://app.devin.ai/sessions/15a3e842d67a434da19033908ebf8eb0
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring