feat(store): add PostgreSQL foundation [T-009]

deploy/postgres/001_roles.sql

@@ -0,0 +1,24 @@
+-- T-009 cluster roles. Runtime login roles are deployment-specific members of
+-- these NOLOGIN roles; passwords and login principals never belong in Git.
+
+DO $roles$
+DECLARE
+    role_record pg_roles%ROWTYPE;
+BEGIN
+    SELECT * INTO role_record FROM pg_roles WHERE rolname = 'bell_app';
+    IF NOT FOUND THEN
+        CREATE ROLE bell_app NOLOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION;
+    ELSIF role_record.rolsuper OR role_record.rolcreatedb OR role_record.rolcreaterole
+          OR role_record.rolreplication OR role_record.rolcanlogin THEN
+        RAISE EXCEPTION 'existing bell_app role has unsafe attributes';
+    END IF;
+
+    SELECT * INTO role_record FROM pg_roles WHERE rolname = 'sense_app';
+    IF NOT FOUND THEN
+        CREATE ROLE sense_app NOLOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION;
+    ELSIF role_record.rolsuper OR role_record.rolcreatedb OR role_record.rolcreaterole
+          OR role_record.rolreplication OR role_record.rolcanlogin THEN
+        RAISE EXCEPTION 'existing sense_app role has unsafe attributes';
+    END IF;
+END
+$roles$;