feat(authz): add database-backed PermissionStore

Adds dbPermissionStore/ensureAuthzTables/authzMigrationSql, backed by
_wrn_authz_assignment and _wrn_authz_grant tables, plus a ./db subpath
export. Passes the identical 19-test store-conformance suite the memory
adapter passes, including tenant-scope isolation.

docs/public-api-0.8.json

@@ -516,6 +516,11 @@
         "requireRole",
         "safeRecord",
         "scopeKey"
+      ],
+      "./db": [
+        "authzMigrationSql",
+        "dbPermissionStore",
+        "ensureAuthzTables"
       ]
     },
     "@wrnexus/benchmark": {