refactor(store/postgres): split adapter by domain and extract shared helpers

[jmgilman]

Summary

• Splits store/postgres/store.go (1584 lines, 6 fused domains) into per-domain files: principal.go, role.go, provisioning.go, identity.go, oidc.go, token.go, plus shared helpers tx.go (generic withTx), errors.go (isPostgresCode), codec.go (JSONB encode/decode), clone.go (defensive copies), validation.go (string validators / dedup).
• withTx[T any] collapses four repeated Begin/defer Rollback/Commit blocks (CreateProvisioningRule, UpdateProvisioningRule, ProvisionIdentity, passkey CreateRegistration). ProvisionIdentity uses a package-private sentinel errProvisionIdentityConflict so the post-rollback read for race recovery happens after withTx unwinds.
• Consolidates the duplicate findIdentityLink (was a method on *Store and a free function in passkey.go) into one free function shared by LinkIdentity, resolveIdentityLinkConflict, and linkPasskeyIdentity.
• Test files mirror the new layout with per-domain TestStoreSatisfiesXContracts compile-time port-assertion bundles; store_integration_test.go is untouched.
• Adds godocs on every previously-undocumented unexported helper. Adds inline comments for: the migration advisory lock, transaction scopes, the credential-binding-pinned WHERE clause in UpdateCredentialAfterLogin as a security invariant, the malformed-hash rejection in findToken, the cross-principal rebind rejection, and the race-recovery path in ProvisionIdentity.
• Public surface unchanged: go doc ./store/postgres shows exactly func Migrate(...), type Store struct{ ... }, func NewStore(...). Behavior unchanged.

This is PR C of a three-PR storage-package refactor; PR A (internal/storetest, #56) and PR B (store/memory, #57) have both landed.

Test plan

• moon run root:check --summary minimal (vet, lint, build, format, unit tests)
• moon run root:integration (Testcontainers Postgres suite)
• go doc ./store/postgres matches master
• git diff --check (no whitespace damage)
• store.go dropped from 1584 → 68 lines; heaviest production file is now passkey.go at 499 lines (was 486; +13 from added godocs and withTx adoption)

🤖 Generated with Claude Code