1.6.1: add CONNECT introspection and tri-state public control (#181)

* feat(database): add CONNECT introspection and tri-state public control

- Add get_database_connect_access(connection, database_name) that reads
  pg_database.datacl and returns (public_has_connect, roles_with_connect);
  handles NULL ACL (PostgreSQL default = PUBLIC has CONNECT)
- Rename configure_database_connect_access parameter revoke_public: bool
  to public: bool | None (tri-state): False revokes, True grants, None
  (default) leaves PUBLIC unchanged; add the missing GRANT branch
- Export get_database_connect_access via pum.__init__
- Update pum db access CLI to pass public=False|None instead of the old
  revoke_public flag

feat(roles): skip permission expectations for isolated generic roles

In roles_inventory / _build_role_status, detect when suffixed variants
exist and pass check_permissions=False for the generic role so that its
SchemaPermissionStatus entries have expected=None and never show as
mismatched (the generic role is intentionally not granted schema
permissions under the role isolation model).

test: update and extend test coverage

- Fix all revoke_public=True call sites -> public=False in test_database.py
- Add test_get_database_connect_access_default, _after_revoke_public,
  _nonexistent_database
- Extend test_roles_inventory_with_suffix: assert expected=None and
  satisfied=True on all generic role schema_permissions; assert
  expected is not None on suffixed role schema_permissions

* fix test