feat(security): serialize Brio database operations

[kaanyagci]

Summary

• add the root-owned four-hour Brio operation lease endpoint and fixed three-node coordinator
• acquire app → identity → database before PostgreSQL mutations and release in reverse
• require a matching local deployment lease at every mutating database entrypoint
• inventory the host-only Proton bootstrap fields without adding GitHub credentials

Stack

This PR is intentionally stacked on #12 at exact parent 30ccdcfc7e72e8a342ae8fa445b7238f5be5e871. Do not merge it independently of the reviewed stack.

Verification

• PYTHONDONTWRITEBYTECODE=1 scripts/run-ci.sh
• all 3 commits are GPG-signed