feat: upstream constructive-db changes to pgpm-modules

[pyramation]

Summary

Syncs schema changes from constructive-db/pgpm-modules that landed after the last upstream (v0.20.2, Apr 9).

New table:

• rate_limits_module — full deploy/revert/verify triplet + pgpm.plan entry. Tracks rate limit settings, IP rate limits, and rate limits tables per database. Has 5 FK constraints (→ database, schema, and 3 → table) plus a UNIQUE(database_id) constraint.

Deploy changes:

• sessions_module: default for auth_settings_table renamed from 'app_auth_settings' → 'app_settings_auth'
• storage_module: 4 new nullable columns for S3 connection config (endpoint, public_url_prefix, provider) and CORS (allowed_origins)

Snapshot updates:

• modules.test.ts.snap updated: rate_limits_module added to module list (22 → 23 modules, 28 → 29 total tables), sessions_module default rename reflected, and constraint-count snapshots updated (64152 → 69575, 92266 → 99730).

All 24/24 CI checks pass.

Review & Testing Checklist for Human

• sessions_module default rename: app_auth_settings → app_settings_auth is a semantic change. Verify downstream generators/consumers in constructive-db and constructive already expect the new name before merging.
• rate_limits_module FK targets: Confirm that metaschema_public.database, metaschema_public.schema, and metaschema_public.table all exist in the deployed metaschema at deploy time (they should, since rate_limits_module depends on metaschema_modules_public/schema).
• storage_module column placement: New S3/CORS columns are inserted mid-table (after entity_table_id, before the expiry settings). Confirm no downstream code relies on column ordinal position.

Notes

• Verify-file alignment changes for blueprint, relation_provision, and secure_table_provision were initially included but reverted — the deploy files in this repo still use the old column names (nodes, create_index, expose_in_api etc.), so updating the verify scripts would break integration tests. Those verify changes should be upstreamed together with their corresponding deploy changes in a future PR.
• The storage_module new columns are all NULL-default, so they're backward-compatible for existing deployments.
• The constraint-count snapshots (69575 / 99730) are fragile — they come from information_schema cross-joins and will break again whenever any module table adds or removes FK constraints. Consider removing the toMatchSnapshot() calls from those two tests in a follow-up (the toBeGreaterThan assertions are the real safety net).

Link to Devin session: https://app.devin.ai/sessions/f3bc277e0b394290b411b493b7bff17a
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring