[deploy] #23 One-command bootstrap

[vxfemboy]

M0 (#166). A single install.sh: Postgres DB + least-priv roles + migrations + first apply, secrets from the gitignored raw/ pattern, folded into pg-backups.
Status: PARTIAL (migrations-on-boot exist; pg-backups auto-covers a new DB) · Size: S/M · Home: deploy repo.
Pro: deploys + backs up like the other containers. Con: small — write install.sh (DB/role/secrets/first-apply).