Provision mars_app_runtime low-priv role, split statement_timeout from postgres

MARS-174/pool-exhaustion follow-on (Elazar GO relayed coder-mars-cc, 2026-09-05). App DATABASE_URL and db-mars-cc's own direct-5432 admin connection both authenticated as postgres, so statement_timeout=10000 (needed to bound the retry wrapper's held slots) could not be set without also aborting long DB-lane migrations/exports. Created mars_app_runtime: LOGIN, DML-only (SELECT/INSERT/UPDATE/DELETE on public tables + defaults for future ones, USAGE/SELECT sequences, SELECT on auth.users for the OAuth callback dangling-authid check), statement_timeout=10000 scoped to this role only (migration 127, df37d98). audit-mars-ca BLOCKed the initial blanket EXECUTE-on-all-functions grant (re-exposed cron_auth_header's CRON_SECRET bearer, closed by MARS-380, plus fn_dbperf_statements_top50) -- fixed same night with an explicit 15-function allowlist, no default-privileges grant going forward (migration 128, f573b38), audit-mars-ca PASS:f573b38 deep. Adjacent to open MARS-417 (function/sequence privilege inventory, broader scope: anon/authenticated/PUBLIC, not done by this WI) and MARS-490 (per-agent login roles reference impl, still open -- this is a per-runtime-consumer role, not the per-fleet-agent pattern that WI asks for).