Add an auth read-replica database client

[jakubno]

Note

Introduces a dedicated authdb.Client with Read/Write separation and optional read-replica, and refactors services to use it for auth flows.

• Infra: Adds postgres-read-replica-connection-string secret and passes AUTH_DB_* env vars in Nomad/API; updates Terraform wiring
• API: New config AUTH_DB_CONNECTION_STRING, AUTH_DB_READ_REPLICA_CONNECTION_STRING, pool sizing; defaults to POSTGRES_CONNECTION_STRING when unset
• Refactor: Moves auth-related queries (users, teams, API keys, access tokens) to packages/db/pkg/auth with generated auth/queries; updates handlers, team/db helpers, and caches to use authdb.Client; background UpdateLastTimeUsed
• DB pkg: Extracts shared pool builder; adds builds.ToMachineInfo; removes direct machineinfo-from-EnvBuild coupling
• Docker reverse proxy: validates access tokens via authdb.Client
• Tests/seed: Update test utilities, integration tests, and seed scripts to new clients; add packages/db Makefile seed-db
• Misc: Go module/deps adjustments and small API job env rearrangement

^{Written by Cursor Bugbot for commit ddc8fdc. This will update automatically on new commits. Configure here.}

[linear]

ENG-3433 Auth read replica

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7ebcccb8f5

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[jakubno]

I wanted to remove the shared dependency on db (it was circular)

[jakubno]

moved to db package

[dobrac]

lgtm, jsut few nits

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}