feat(db): migrate to PostgreSQL 16 standalone

- docker-compose.prod.yml: add postgres:16-alpine service with health check,
  dedicated prod_leopost_net, backup volume mount, connection pool
- requirements.txt: add psycopg2-binary==2.9.9
- database.py: remove SQLite-specific run_migrations(), add PG pool_size/
  max_overflow/pool_pre_ping, keep sqlite compat for dev
- main.py: remove run_migrations call, rely on create_all for PG
- scripts/migrate_sqlite_to_pg.py: one-shot data migration script

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker-compose.prod.yml

@@ -1,4 +1,29 @@
 services:
+
+  postgres:
+    image: postgres:16-alpine
+    container_name: prod-leopost-postgres
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: leopost
+      POSTGRES_USER: leopost
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-leopost_pg_2026}
+    volumes:
+      - ./pgdata:/var/lib/postgresql/data
+      - ./backups:/backups
+    networks:
+      - prod_leopost_net
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U leopost -d leopost"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    deploy:
+      resources:
+        limits:
+          memory: 512M
+          cpus: '0.5'
+
   app:
     build:
       context: .
@@ -9,15 +34,19 @@ services:
     container_name: prod-leopost-full-app
     restart: unless-stopped
     command: ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]
+    depends_on:
+      postgres:
+        condition: service_healthy
     volumes:
       - ./data:/app/data
     environment:
-      - DATABASE_URL=sqlite:///./data/leopost.db
+      - DATABASE_URL=postgresql://leopost:${POSTGRES_PASSWORD:-leopost_pg_2026}@postgres:5432/leopost
       - APP_URL=https://leopost.it
       - GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID}
       - GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET}
       - SECRET_KEY=${SECRET_KEY:-leopost-prod-secret-2026}
     networks:
+      - prod_leopost_net
       - proxy_net
     deploy:
       resources:
@@ -26,5 +55,7 @@ services:
           cpus: '1.0'
 
 networks:
+  prod_leopost_net:
+    name: prod_leopost_net
   proxy_net:
     external: true