feat(storage): durable Postgres store + shipped migrations (FOR UPDATE SKIP LOCKED) (#38)

[williamdewitt]

Closes #38 — the scale-up production storage tier for the M2 epic (#8). risk:critical (ships EF migrations → migration-safety review; does not auto-merge).

What this delivers

• One-line opt-in, both modes:
  • Standalone: AddCaliberWebhooks(o => o.UsePostgres("Host=…;Database=…;Username=…;Password=…"))
  • Outbox: existing UseEntityFramework<TContext>() now detects an Npgsql caller context and shares its database.
  • Both route through a single CaliberNpgsqlConfiguration.Apply(...) so every entry point (standalone, outbox, design-time) configures Npgsql identically.
• No-double-send claim, pushed to one atomic SQL statement per provider in EfMessageStore:
  • Postgres: UPDATE messages … FROM (SELECT id … WHERE due ORDER BY next_attempt_at FOR UPDATE SKIP LOCKED LIMIT @batch) … RETURNING … — N dispatchers claim disjoint batches with no contention.
  • SQLite (unchanged): equivalent UPDATE … RETURNING; the single writer serialises it.
  • Fan-out idempotent on (event_id, endpoint_id) via ON CONFLICT DO NOTHING (both providers).
• Shipped, reviewed migration (InitialCreate) applied on startup — CaliberWebhooksPostgresMigrator (standalone) / provider-aware CaliberWebhooksSharedSchemaInitializer (outbox: migrate on PG, create-tables-if-missing on SQLite). No EnsureCreated in production.
• Migrations tracked in a dedicated __caliber_migrations_history table so they never collide with the caller's own migrations when Caliber shares the caller's database (outbox mode).
• Microsoft.EntityFrameworkCore.Design is design-time only (PrivateAssets=all) — never flows to consumers. Npgsql provider pinned to the EF Core 8 line (8.0.11) to unify with the existing Sqlite 8.0.28 pin under transitive pinning.

Migration-safety review

Generated SQL (dotnet ef migrations script --idempotent) is purely additive and idempotent — CREATE TABLE / CREATE INDEX guarded by IF NOT EXISTS … __caliber_migrations_history. No DROP, no destructive ALTER, no data movement. Indexes match the access paths:

• IX_messages_status_next_attempt_at — the claim predicate + ORDER BY.
• unique IX_messages_event_id_endpoint_id — backs idempotent fan-out (ON CONFLICT).
• IX_endpoints_enabled — endpoint lookup.

Verification

• dotnet build — 0 warnings, 0 errors (net8.0 + net10.0).
• dotnet test — 203 / 203 pass on both targets.
• dotnet ef migrations script generates clean Postgres DDL.

Scope / follow-ups

• Cross-instance no-double-send proof (Testcontainers + N concurrent dispatchers, incl. crash-recovery) is test(storage): prove no-double-send across instances (Testcontainers + Postgres) #39, blocked by this; its test-only dependencies (Testcontainers.PostgreSql, the Logging.Abstractions bump) land there, not here, to keep this slice focused on the store + migrations.

🤖 Generated with Claude Code