feat: add PostgreSQL primary/replica apply scripts for the DB VMs

WP-09(Terraform 설계서 6.10, 실험·앱 설계서 3.3).
- postgres-primary: PostgreSQL 16, conf.d 오버라이드(listen *, ssl on, scram, wal_level
  replica, slot 10, wal_keep_size 256MB), pg_hba는 hostssl+scram만(app: AWS·GCP 대역,
  harness: GCP 대역, replicator: 10.20.0.21). 역할 app/replicator/harness(비밀번호는
  Secret Manager selfheal-db-password), DB app + 스키마 app.price·app.orders + 시드.
  harness에 pg_wal_replay_pause/resume·pg_promote EXECUTE와 pg_read_all_stats 부여
  (카탈로그 db.replay_resume·db.promote).
- postgres-replica: 첫 실행에 pg_basebackup -R -C -S replica1(TLS 필수)로 standby 구성,
  이후 실행은 재시작만.

vm/postgres-replica/apply.sh

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+# db-replica (10.20.0.21): hot standby of db-primary via streaming replication (Terraform design 6.10;
+# PostgreSQL docs 26.2.4/26.2.5). First run: pg_basebackup -R (creates standby.signal + primary_conninfo, slot replica1).
+# Re-runs leave an existing standby alone. Password from Secret Manager via the VM SA.
+set -euo pipefail
+export DEBIAN_FRONTEND=noninteractive
+PGV=16
+PRIMARY_IP=10.20.0.20
+DATA=/var/lib/postgresql/${PGV}/main
+CONF=/etc/postgresql/${PGV}/main
+
+apt-get update -qq
+apt-get install -y -qq postgresql-${PGV} jq >/dev/null
+install -d -m 755 -o postgres -g postgres "$CONF/conf.d"
+cat > "$CONF/conf.d/10-selfheal.conf" <<CONF
+# managed by selfheal-lab-gitops vm/postgres-replica/apply.sh
+listen_addresses = '*'
+ssl = on
+password_encryption = 'scram-sha-256'
+hot_standby = on
+log_line_prefix = '%m [%p] %u@%d '
+CONF
+cat > "$CONF/pg_hba.conf" <<HBA
+# managed by selfheal-lab-gitops vm/postgres-replica/apply.sh
+local   all             postgres                                peer
+local   all             all                                     peer
+hostssl app             app             10.10.0.0/16            scram-sha-256
+hostssl app             app             10.20.0.0/20            scram-sha-256
+hostssl all             harness         10.20.0.0/20            scram-sha-256
+HBA
+chown postgres:postgres "$CONF/conf.d/10-selfheal.conf" "$CONF/pg_hba.conf"; chmod 640 "$CONF/pg_hba.conf"
+
+if [ -f "$DATA/standby.signal" ]; then
+  echo "already a standby; restarting to pick up config"
+  systemctl restart postgresql
+else
+  PROJECT="$(curl -sf -H 'Metadata-Flavor: Google' http://metadata.google.internal/computeMetadata/v1/project/project-id)"
+  TOKEN="$(curl -sf -H 'Metadata-Flavor: Google' 'http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token' | jq -r .access_token)"
+  PGPASSWORD="$(curl -sf -H "Authorization: Bearer ${TOKEN}" "https://secretmanager.googleapis.com/v1/projects/${PROJECT}/secrets/selfheal-db-password/versions/latest:access" | jq -r .payload.data | base64 -d)"
+  unset TOKEN; export PGPASSWORD
+  [ -n "$PGPASSWORD" ] || { echo "empty DB password" >&2; exit 1; }
+  systemctl stop postgresql
+  rm -rf "$DATA"
+  install -d -m 700 -o postgres -g postgres "$DATA"
+  sudo -u postgres PGPASSWORD="$PGPASSWORD" PGSSLMODE=require pg_basebackup -h "$PRIMARY_IP" -U replicator -D "$DATA" -R -X stream -C -S replica1 -P
+  unset PGPASSWORD
+  systemctl start postgresql
+fi
+sleep 3
+echo "--- replica status"
+sudo -u postgres psql -Atc "select pg_is_in_recovery()"
+sudo -u postgres psql -Atc "select status, sender_host, slot_name from pg_stat_wal_receiver" 2>/dev/null || true