Pr2 branch postgresql dialect

[webgress]

PR2 of the 4-PR PostgreSQL backend split (PR1 merged as #276).

Summary

• Adds PostgreSQLDialect implementing the Dialect interface.
• Wires the pgx driver into store.Open() for postgres:// URLs.
• Adds schema_pg.sql with a tsvector FTS column and GIN index.
• Adds PostgreSQLEngine scaffold parallel to SQLiteEngine.
• Adds dual-backend test harness via MSGVAULT_TEST_DB (make test-pg).
• Aligns PostgreSQLDialect with the post-review PR1 interface (FTSUpsert, ?-placeholder FTSSearchClause, InsertOrIgnorePrefix, FTSRebuildSchema, IsBusyError).

Status

PostgreSQL is not functionally usable after this PR — see docs/PG_STATUS.md for the full punch list. The blockers (schema type translation, Rebind threading, LastInsertId →
RETURNING, query-engine parameterization) land in PR3.

SQLite remains the default and only production-ready backend; SQLite test suite is unchanged.

[roborev-ci]

roborev: Combined Review (97381ab)

Summary verdict: PostgreSQL support has several contract and test-runner issues that should be fixed before merge.

High

• Location: Makefile:64
  Problem: make test-pg appears to have a malformed shell if statement: cmd/msgvault/cmd/verify.go was pasted where if should be, which will make the target fail.
  Fix: Change it to:

  @if [ -z "$$MSGVAULT_TEST_DB" ]; then \

Medium

• Location: internal/query/postgres.go:91
  Problem: PostgreSQLEngine.GetMessage returns partial message details and does not exclude soft-deleted messages, unlike SQLite. Participants, labels, attachments, ReceivedAt, and raw-body fallback are missing, so callers using the shared Engine interface get incomplete or inconsistent results.
  Fix: Mirror SQLite’s getMessageByQuery behavior for PostgreSQL, or return ErrNotImplemented until the full contract is implemented.

• Location: internal/query/postgres.go:216
  Problem: PostgreSQL GetTotalStats applies HideDeletedFromSource and related filters only to message counts. Attachment counts and sizes are queried from attachments directly or only filtered by source_id, so attachments from deleted or otherwise filtered-out messages can still affect stats.
  Fix: Build attachment stats by joining messages and applying the same message filters used for MessageCount.

• Location: internal/store/store.go:213
  Problem: PostgreSQL read-only mode is set with SET default_transaction_read_only = ON on a pooled *sql.DB, which only affects the connection used for that statement. Later operations can run on newly opened writable connections despite OpenReadOnly.
  Fix: Configure the runtime parameter for every pgx connection, for example via connection config/runtime params or an AfterConnect hook.

---

Synthesized from 3 reviews (agents: codex, gemini | types: default, security)

[roborev-ci]

roborev: Combined Review (8c540c1)

PostgreSQL support has a few blocking correctness issues: one broken test target and two schema/query bugs.

High

• Location: Makefile:64
  Problem: The test-pg target has a typo/paste error: @cmd/msgvault/cmd/verify.go appears where @if should be, causing the make target to fail with a shell syntax error.
  Fix: Change:

  @cmd/msgvault/cmd/verify.go [ -z "$$MSGVAULT_TEST_DB" ]; then \

  to:

  @if [ -z "$$MSGVAULT_TEST_DB" ]; then \

Medium

• Location: internal/query/postgres.go:159
  Problem: The initial message_type OR condition is joined with later filters without parentheses, so SourceID, WithAttachmentsOnly, and HideDeletedFromSource only apply to the final m.message_type = '' branch. Filtered PostgreSQL stats can overcount email rows from other sources or deleted rows.
  Fix: Wrap the OR group, for example:

  (m.message_type = 'email' OR m.message_type IS NULL OR m.message_type = '')

  and add a filtered stats test.

• Location: internal/store/dialect_pg.go:130
  Problem: The information_schema.columns probes do not constrain table_schema, so FTSAvailable and SchemaStaleCheck can report success based on another schema in the same database. This conflicts with per-test-schema PostgreSQL isolation and deployments using search_path.
  Fix: Restrict these checks to the active schema, such as table_schema = current_schema(), or resolve the target table through the current search_path.

---

Synthesized from 3 reviews (agents: codex, gemini | types: default, security)

[roborev-ci]

roborev: Combined Review (184b148)

High-level verdict: changes need fixes before merge due to one broken test target and several PostgreSQL correctness/build issues.

High

• Makefile:64
  The test-pg target appears to contain an accidental paste: @cmd/msgvault/cmd/verify.go instead of @if. This will cause make test-pg to fail with a syntax or execution error.
  Fix: Change it to:

  @if [ -z "$$MSGVAULT_TEST_DB" ]; then \

Medium

• go.mod:19
  The diff adds github.com/jackc/pgx/v5 and related dependencies, but matching go.sum updates are missing. This can break readonly module builds or cause test/build commands to modify the workspace.
  Fix: Run go mod tidy and commit the generated go.sum entries.

• internal/query/postgres.go:156
  The initial message_type condition is joined with later filters without parentheses, so SQL precedence makes filters like source_id, has_attachments, and deleted_from_source_at apply only to the last OR branch.
  Fix: Wrap the OR group in parentheses before appending additional AND filters.

• internal/store/dialect_pg.go:134
information_schema.columns checks only table_name and column_name, so isolated PostgreSQL test schemas or non-public deployments can see columns from another schema and report FTS or migration state incorrectly.
  Fix: Restrict these checks to the active schema, for example with table_schema = current_schema().

---

Synthesized from 3 reviews (agents: codex, gemini | types: default, security)

[wesm]

Thank you, I will review this and merge soon