feat: isolate Postgres schema

[gavinelder]

Summary

• add wave.db.schema / WAVE_DB_SCHEMA and route Postgres connections to the configured schema
• add startup guard to fail fast when legacy public.wave_* tables remain
• add operator-run public-to-schema migration script and migration docs
• update install docs/env templates for dedicated schema setup
• add Postgres schema service tests for default/custom schemas, invalid schema, and legacy-public guard

Verification

• ./gradlew testClasses
• git diff --check

Notes

The targeted Testcontainers Postgres test could not be completed in the earlier local run because Docker was not available in that environment; the test coverage is included for CI.