db: add raw reference-edge schema with lifecycle-safe grants

[IceRhymers]

Part of #82.

Summary

Add the raw reference-edge table(s) to the Lakebase schema via Alembic, with indexes for the query-time resolver and lifecycle-safe grants.

Scope

• Alembic revision (autogenerate + op.execute where needed — no hand-authored SQL files) adding an edge table shaped for the raw-edge model: id, repo_id (FK, cascade), file_id (FK, cascade), edge_kind (call | import), target_name, line, and enclosing-symbol attribution. Recommendation from the deep dive: denormalize enclosing symbol (name, kind, start_line, end_line) rather than FK to symbols — symbol ids churn on every per-file reinsert, and an FK would couple the two rewrite orders inside the transaction for no query benefit.
• Indexes: target_name (btree + GIN trgm — the resolver joins on it), file_id (delete-and-reinsert lifecycle), (repo_id, edge_kind) as needed by the tool queries.
• Grants verification (carried from the trace as an explicit unknown): no migration has ever added a brand-new table after initial grants; verify on a fresh dev deploy that ALTER DEFAULT PRIVILEGES actually gives the app SP SELECT and the job SP DML on the new table without deploy.sh --apply-grants. If it does not, document the required step in the deploy runbook.

Acceptance criteria

• Migration applies cleanly on local Postgres (CI integration path) and on Lakebase dev.
• App SP can SELECT and job SP can INSERT/DELETE on the new table on a fresh deploy, or the runbook documents the extra grant step.
• No cross-file/cross-repo symbol FK anywhere in the schema.
• EXPLAIN on the resolver join shape (target_name equality + trgm) confirms index usage on fixture data.

[IceRhymers]

Completed via child PR #90, squash-merged into the #82 integration branch (integration/knowledge-graph-reference-edges). The umbrella draft PR #89 remains open until the full epic is integrated and human-reviewed into protected master.