Migrate PostgresStore from pgx v4 to v5

[jdtw]

Summary

Closes the last two open Dependabot alerts (pgproto3/v2 DoS, pgx SQL injection) -- neither has a fix in the pgx v4 line, only v5.9.2+.

• pgx/v4 was only imported in pkg/links/postgres.go. The only real API change was pgxpool.ConnectConfig → pgxpool.NewWithConfig; everything else (QueryRow/Exec/Query/Scan, pgx.ErrNoRows, the RETURNING (xmax = 0) trick from Fix Postgres created/updated status, key normalization, reserved key, and frontend CSRF #23) is unchanged between v4 and v5. Verified the v5 API directly via go doc in a scratch module before writing any code.
• go mod tidy drops pgconn, pgtype, pgproto3/v2, chunkreader, pgio, and puddle v1 (v5 bundles its own updated pgproto3 and pulls in puddle/v2 instead), and drops golang.org/x/crypto entirely -- v5's SCRAM implementation no longer needs it.
• PostgresStore had zero committed test coverage before this -- the created/updated fix from Fix Postgres created/updated status, key normalization, reserved key, and frontend CSRF #23 was only ever checked with a throwaway scratch test. Added pkg/links/postgres_test.go (skips cleanly without DATABASE_URL) to close that gap for good.
• Wired DATABASE_URL-backed go test ./... into docker_test.sh, and reordered .github/workflows/test.yml so table creation happens before the Test step (it previously ran after, which would have made a Postgres-backed Go test fail in CI).

Test plan

• gofmt -l ., go build ./..., go vet ./...
• go test ./... -count=1
• Forced uncached go test -run TestPostgres -v -count=1 against a real local Postgres -- all four new tests actually execute (not skipped/cached) and pass under pgx v5, including the created-vs-updated regression check
• Full ./docker_test.sh run, covering the bash-level integration suite too
• go list -m all confirms pgx/v4 and the old pgproto3/v2 are fully gone from the module graph

🤖 Generated with Claude Code