feat(authz): add database-backed PermissionStore

Adds dbPermissionStore/ensureAuthzTables/authzMigrationSql, backed by
_wrn_authz_assignment and _wrn_authz_grant tables, plus a ./db subpath
export. Passes the identical 19-test store-conformance suite the memory
adapter passes, including tenant-scope isolation.

packages/authz/test/store-db.test.ts

@@ -0,0 +1,11 @@
+import { createDb } from "@wrnexus/db";
+import { sqlite } from "@wrnexus/db/sqlite";
+import { dbPermissionStore, ensureAuthzTables } from "../src/db.ts";
+import { runStoreConformance } from "./store-conformance.ts";
+
+// The db adapter must satisfy exactly the same contract as the memory one.
+runStoreConformance("sqlite", async () => {
+  const db = createDb(sqlite(":memory:"));
+  await ensureAuthzTables(db, "sqlite");
+  return dbPermissionStore(db);
+});