Per-agent Postgres login roles (REFERENCE impl)

Per EVO-56 - MARS is the reference implementation. db-mars-cc drafts: per-agent LOGIN roles, DML-only least-privilege grants; DDL stays via postgres role (SET ROLE postgres) - single object-owner + default-ACL grantor; attribution via session_user in pg_stat_activity/logs + optionally stamp session_user in archive triggers alongside app.user_id; passwords via llmmsg DM + ltm. Class-A: audit-mars-ca design-ping BEFORE apply. Draft the pattern for Pluto/Venus to adopt. Report the ratified design to PM + me.