fix: address review findings on postgres backend

- PostgresMigrator: run JS migration parts on the transactional client
  (WrappedPgTx) instead of the pool, preserving migration atomicity
- pool.ts: guard ROLLBACK so a failing rollback no longer masks the
  original error (also applied in the migrator loop)
- pool.ts: share all/get/run between WrappedPool and WrappedPgTx via a
  common base class
- sql.ts: document that toPositional precludes JSONB ?/?|/?& operators
- PostgresInterface: implement deleteSession, required by
  BackendDbInterface since the logout-invalidation change on master

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/db/postgres/PostgresInterface.ts

@@ -408,6 +408,14 @@ export class PostgresInterface implements BackendDbInterface {
     `);
   }
 
+  async deleteSession(token: `as_${string}`): Promise<void> {
+    this.#checkReadonly();
+    await this.#db.run(sql`
+      DELETE FROM "sessions"
+      WHERE "token" = ${{ text: token }}
+    `);
+  }
+
   async #getApikeyByToken(
     token: `at_${string}`,
     db: WrappedPgClient