feat(postgres): import key metadata for SELECT-only roles with catalog access

[vtulus]

Summary

Extends #1423 with PostgreSQL catalog-backed key metadata for read-only imports.

PostgreSQL hides constraint metadata from roles that have only application-table SELECT, forcing users to supplement imports manually even when catalog reads
are available.

Postgres import
  tables and columns  <- information_schema (required)
  primary keys        <- pg_catalog, else information_schema
  foreign keys        <- pg_catalog, else omitted

  complete constraints only
    one-column FK     -> property relationship
    composite FK      -> schema relationship

Catalog access is optional: a role with full-table SELECT, schema USAGE, and catalog read access imports primary and foreign keys. If catalog access is denied, table/column import still succeeds; primary keys fall back to information_schema and foreign keys are omitted. Relationships are retained only when both complete endpoints are included in the selected schema.

Evidence

• Before: Add Postgres import #1423 read primary keys through information_schema; a SELECT-only role could receive a usable contract without primary keys, and PostgreSQL foreign keys were not imported.

• After: Reads declared primary and foreign keys from pg_catalog when available; primary keys fall back to information_schema and foreign keys are omitted when catalog access is denied.

  • uv run --extra dev pytest tests/test_import_postgres.py tests/test_test_relationships.py passes (36 tests), covering the PostgreSQL 16 SELECT-only role, composite-key atomicity, selected-table and cross-schema cases, plus relationship-test regression coverage.

Merge Danger

The change is limited to PostgreSQL import output.

Blast Radius: PostgreSQL

Imported contracts may gain declared primary keys and relationships when the role can read PostgreSQL catalogs; restricted catalog access continues to degrade gracefully.

• Tests pass (uv run pytest)
• Code formatted (uv run ruff check --fix && uv run ruff format)
• Docs updated (if relevant)
• CHANGELOG.md entry added

[jschoedl]

Thank you for the PR!