feat(cli): port supabase test db and test new

[Coly010]

What changed

Native TypeScript port of supabase test db and supabase test new into the legacy shell (stable channel), replacing the Phase-0 Go proxies.

• test new — writes supabase/tests/<name>_test.sql from the embedded pgtap template; matches Go's relative-path success message, file location, and exit codes. --template (pgtap).
• test db — --db-url / --local / --linked + variadic paths. Connects via @effect/sql-pg to enable/disable the pgTAP extension, then runs supabase/pg_prove:3.36 through docker run (read-only volume mounts, --security-opt label:disable, local docker network or host networking). Honors --network-id, and the db-url/linked/local mutual-exclusivity is byte-for-byte identical to Go's cobra error.

New shared infrastructure (for upcoming db reset / db dump ports)

• LegacyDbConnection — Postgres connection seam (single swap point for the driver).
• LegacyDbConfigResolver — --db-url / --local / --linked resolution, including the linked sub-flow (temp login-role via V1CreateLoginRole, pooler fallback with a public-suffix MITM domain check, network-ban unban, backoff). Ports Go's flags.ParseDatabaseConfig + NewDbConfigWithPassword.
• LegacyDockerRun — one-shot docker run runner.

The Management API stack is built lazily on the --linked branch only, so --local / --db-url never resolve an access token (auth-free, matching Go).

Reviewer notes

• Driver choice: added @effect/sql-pg (4.0.0-beta.75, pure-JS pg); verified it bundles and round-trips under bun build --compile.
• pgTAP drop-skip: PgClient exposes no OnNotice hook, so "already installed" is detected with a pg_extension pre-check before enabling — equivalent observable behavior to Go's notice-code 42710 callback.
• Credentials are kept out of all error output (docker spawn failure, db-url parse failure).
• Documented divergences (see SIDE_EFFECTS.md): test db has no --output-format machine envelope (Go has none; TAP streams to stdout in all modes); the [images] pgprove config override is not modeled by the TS config schema.

Known follow-up

The --linked sub-flow (login-role / pooler / unban / backoff) is implemented and type-checked but lacks a dedicated integration test — it requires the real management runtime with a mocked HTTP transport and a real linked project to verify faithfully. The local/db-url resolver paths and toml parsing are covered.

Closes CLI-1318