[maritonx]

Closes #156 (M5, ADR-0055 L1 step 1).

CI

• The pgbouncer job now connects as role cms, whose search_path is its own schema easy_cms. The role is set up with the same three statements the docs show, and it has no rights on public.
• The postgres job stays on public.
• New postgres-schema.test.ts checks that every table lands in easy_cms and none in public, both from push and from migration files (createMigration → migrate → verify). It runs only when POSTGRES_SCHEMA is set.
• Test cleanup now drops tables in current_schema() instead of public.

Docs

New page Database isolation (EN/TH), linked from Databases and the sidebar. It covers:

• L0–L3 and when to pick each
• a separate pool isolates only connections, not CPU, IO or locks
• the L1 setup
• what happens when you forget the role: on Postgres 15+ the first start fails with "permission denied for schema public"
• GRANTs so the app can read CMS tables
• moving an existing install from L0 to L1
• L2/L3 need only their own url

The schema option (#172) and the DML-only role (#173) are mentioned in one line as planned.

No changeset: no package changes. The website shows these docs from the next release, or earlier via docs-ref.txt.

Verified locally (Docker, Postgres 17 + PgBouncer 1.26)

• Postgres suites as cms through PgBouncer: 351 passed. Afterwards no Easy CMS table is in public.
• A role without search_path: gets "permission denied for schema public", as the docs say.
• Moving an install from L0 to L1 with the documented SQL: the old data stays and new ids continue from the old ones. verify passes, nothing is re-applied, and all 9 tables are in easy_cms.
• Other checks:
  • pnpm turbo run test --continue 53/53
  • docs tests 85/85
  • vitepress build passes, with matching EN/TH anchors
  • biome ci passes (the 7 warnings were already there)

🤖 Generated with Claude Code