013: PgBouncer transaction pooling on localhost:6432

Serverless clients -> many short connections, few TPS. pool_mode=
transaction, max_client_conn=300, default_pool_size=20 (+reserve 5)
matching max_connections=30. max_prepared_statements=200 for ORM
prepared statements. localhost-only until remote-access migration
(roadmap 015). README table + notes updated.

README.md

@@ -52,8 +52,22 @@ For a private repo you need an auth strategy:
 | 006 | install-postgres           | PG 18 via PGDG repo, cluster on the disk     |
 | 007 | postgres-admin-role        | iwanhae OS user -> PG superuser (peer auth)  |
 | 008 | create-db-iwanhae          | database `iwanhae` owned by admin role       |
+| 010 | tune-postgres              | 1GB stability: conns=30, cache hint, timeouts, temp_file_limit |
+| 011 | postgres-observability     | pg_stat_statements, slow-log 500ms, io timing |
+| 012 | tune-cpu                   | parallel caps + jit=off for shared 2 vCPU    |
+| 013 | install-pgbouncer          | :6432 transaction pooling, localhost-only    |
+
+## PgBouncer notes (013)
+
+Serverless clients (many connections, few TPS) connect to PgBouncer
+(`127.0.0.1:6432`, transaction mode) which opens at most ~25 real
+PostgreSQL backends - matching `max_connections=30` from 010 with room
+for admin sessions. Remote access is deliberately not opened yet; when
+it is: create an app role with a SCRAM password, export its verifier into
+`/etc/pgbouncer/userlist.txt` (snippet in 013's header), flip
+`listen_addr` and open the firewall.
 
 ## Roadmap
 
-- `010-tune-postgres` - 1GB tuning (shared_buffers=128MB, work_mem=4MB,
-  max_connections=30, ...)
+- `015-remote-access` - app role + SCRAM credentials, pgbouncer
+  `listen_addr` + userlist.txt, pg_hba for the app CIDR, TLS, firewall