feat: centralize PostgreSQL on glyph

[stackptr]

Summary

• Move PostgreSQL from spore to glyph (i7-13700K, NVMe, ZFS) as the central database host
• Switch atticd from SQLite to PostgreSQL, fixing connection pool timeouts under concurrent CI pushes
• Add databaseURL and localDatabase options to rc.web.auth module so pocket-id can connect to a remote database
• Configure pocket-id on spore to connect to glyph's PostgreSQL via Tailscale
• Disable PostgreSQL on spore, move database backups to glyph

Migration steps

Before deploying, migrate the pocketid database from spore to glyph:

1. Deploy glyph first to create the PostgreSQL instance and empty databases:

   nixos-rebuild switch --flake .#glyph

2. Dump pocketid from spore:

   ssh spore sudo -u postgres pg_dump pocketid > pocketid.sql

3. Restore on glyph:

   scp pocketid.sql glyph:
   ssh glyph sudo -u postgres psql pocketid < pocketid.sql

4. Migrate atticd data from SQLite to PostgreSQL on glyph:

   ssh glyph
   # Stop atticd to prevent writes
   sudo systemctl stop atticd
   # Dump SQLite
   sqlite3 /var/lib/atticd/server.db .dump > atticd-sqlite.sql
   # The SQLite dump won't import directly into PG — use pgloader or
   # just start fresh (atticd will recreate its schema). Existing
   # cached NARs in /var/lib/atticd/storage/ are retained; only the
   # metadata DB is lost, so a fresh CI push will repopulate it.

5. Deploy spore to disable local PostgreSQL and point pocket-id at glyph:

   nixos-rebuild switch --flake .#spore

6. Verify pocket-id can reach glyph's database:

   ssh spore psql -h glyph.rove-duck.ts.net -U pocketid -d pocketid -c '\dt'

Test plan

• Deploy glyph, verify PostgreSQL starts and databases are created
• Migrate pocketid data from spore
• Deploy spore, verify pocket-id connects to glyph
• Verify id.zx.dev login works end-to-end
• Verify atticd starts and cache.zx.dev is functional
• Verify CI push to Attic works without connection pool errors

🤖 Generated with Claude Code