Now needs APP_DATABASE_URL, a direct Postgres connection as the app role.
The four runtime roles are created NOLOGIN on purpose — a password in a migration is a password in the repo. See db/roles-setup.md.
Phase 0 is building the boundary, not the assistant. There is nothing to read yet because nothing has been ingested — that is Phase 1a.