feat(postgres): add managed extensions

[vishr]

Summary

• publish ghcr.io/labstack/onebox-postgres:18 with a curated PostgreSQL 18 extension set, including pgvector and pgvectorscale
• add declarative features.extensions reconciliation before application migrations, with dependency-first installation
• preserve protected-image and recovery safety boundaries
• document the user contract and one-time protected-service transition

Verification

• just check
• just workflow-check
• local Onebox binary build
• local PostgreSQL image builds for linux/arm64 and linux/amd64
• extension creation and functional smoke tests for vector, vectorscale DiskANN index scans, PostGIS, pg_cron, HypoPG, and pg_repack
• Trivy OS-package scan (zero high/critical findings); reviewed unreachable upstream gosu standard-library findings
• staged secret scan
• generated docs and production site build