015: remote access - ocrt_dev db over TLS+SCRAM via PgBouncer

- role ocrt_dev (LOGIN, random password in /var/lib/sysmig/secrets,
  not superuser - DB ownership suffices for schema migrations)
- database ocrt_dev owner ocrt_dev
- pgbouncer: listen 0.0.0.0, self-signed CA+cert (SAN=hostname/IPs),
  client_tls_sslmode=require, userlist synced from pg_authid (SCRAM
  pass-through; pg_hba unchanged)
- two pool aliases: ocrt_dev (transaction) and ocrt_dev_migrate
  (session, for advisory-lock-based migration tools)
- 013 status: listen_addr expectation flips once 015 is applied
- GCP firewall tcp:6432 remains a manual step (gcloud cmd in header)

migrations/013-install-pgbouncer.sh

@@ -101,8 +101,14 @@ case "${1:-}" in
     pg_isready -h 127.0.0.1 -p 6432 -q 2>/dev/null \
       || { echo "DRIFT nothing accepting on 127.0.0.1:6432"; exit 1; }
     grep -q '^pool_mode = transaction' "$INI" || { echo "DRIFT pool_mode not transaction"; exit 1; }
-    grep -q '^listen_addr = 127.0.0.1' "$INI" || { echo "DRIFT listen_addr changed (remote access migration?)"; exit 1; }
-    echo "OK pgbouncer on 127.0.0.1:6432, transaction mode"
+    # listen_addr expectation flips once 015 (remote access) is applied
+    if grep -q '^015-' /var/lib/sysmig/applied 2>/dev/null; then
+      want_listen='^listen_addr = 0.0.0.0'; want_desc='0.0.0.0 (015 applied)'
+    else
+      want_listen='^listen_addr = 127.0.0.1'; want_desc='127.0.0.1'
+    fi
+    grep -q "$want_listen" "$INI" || { echo "DRIFT listen_addr not $want_desc"; exit 1; }
+    echo "OK pgbouncer on $want_desc:6432, transaction mode"
     ;;
   down)
     systemctl disable --now pgbouncer 2>/dev/null || true