feat(11-01): add lagoon.OnDatabase and after-commit transactions

- OnDatabase runs a callback once the database is published (now, or when
  lagoon.Publish runs), so GORM callbacks registered at Boot also install
  under serve, where Boot runs before the database is opened
- Transaction runs AfterCommit callbacks in order after a successful commit;
  nested calls are savepoints whose callbacks drop with them
- the lagoon:after_commit GORM callback flushes single-statement AfterCommit
  work after GORM's own commit; outside a transaction it runs immediately

modules/lagoon/README.md

@@ -13,6 +13,8 @@ Postgres data layer: the shared GORM connection, per-plugin migrations, model he
 ## Features
 
 - One shared pool: `lagoon.Open`, `lagoon.Use` and `lagoon.OpenFromApp` return a `*sql.DB` and a `*gorm.DB` built on that same pool; `lagoon.Publish` makes both available on the `backpack.App`.
+- Database-ready hooks: `lagoon.OnDatabase` runs a callback with the pool and GORM handle as soon as the database is published, immediately when it already is, otherwise when `lagoon.Publish` runs. Plugins register GORM callbacks through it from Boot, which runs before the `serve` command publishes the database.
+- After-commit work: `lagoon.Transaction` runs a function in a transaction and then the callbacks registered with `lagoon.AfterCommit`, in order, only after the commit succeeds; a nested `lagoon.Transaction` is a savepoint whose callbacks are dropped with it when it fails. A single-statement write for which GORM opens its own transaction runs its `lagoon.AfterCommit` callbacks from the `lagoon:after_commit` GORM callback (`lagoon.AfterCommitCallback`) once GORM commits, and never when the write fails. Outside both, including inside a plain GORM `Transaction`, `lagoon.AfterCommit` runs the callback immediately. A panicking callback is logged and never turns a committed write into an error.
 - Database check at connect time: `lagoon.CheckLocale` refuses a database whose default collation is not the ICU `pl-PL` locale, so ordering matches the database default without per-query `COLLATE`.
 - Per-plugin migrations: `lagoon.Migrate` runs the framework's `system_files` set (`attach.Migrations`), backend admin identity set (`lagoon.BackendAdminMigrations`) and job-queue set (`lagoon.QueueMigrations`: River's schema pinned at `lagoon.RiverSchemaVersion`, then the `lagoon.JobsTable` record table, under the `lagoon.QueueHistoryID` history), then every `pact.HasMigrations` set in plugin activation order, each in its own `summer_migrations_<plugin_id>` history table (`lagoon.HistoryTableName`). `lagoon.RollbackLast` and `lagoon.Status` cover rollback and history.
 - Mass assignment: `lagoon.Fill` copies only allow-listed keys onto a model by GORM column name and silently drops the rest, logging each dropped key once outside production. A `json.Number` (from a decoder using `UseNumber`) fills integer, unsigned and float fields. A value that does not fit its column (a fraction, an exponent or an overflow for an integer field, or a value of the wrong type) is a `lagoon.FillTypeError` naming the key, so a caller can answer it as a validation failure on that field. `lagoon.HasFillable` and `lagoon.HasHidden` are the Go forms of `$fillable` and `$hidden`.
@@ -64,6 +66,29 @@ func createPost(ctx context.Context, gdb *gorm.DB, tr *phrasebook.Translator, in
 }
 ```
 
+A plugin registers its GORM callbacks from Boot through `lagoon.OnDatabase`, so they are installed whenever the database is published, and defers side effects until the write commits:
+
+```go
+func (p *Plugin) Boot(app *backpack.App) error {
+	return lagoon.OnDatabase(app, func(_ *sql.DB, gdb *gorm.DB) error {
+		return gdb.Callback().Create().After("gorm:after_create").Register("acme:post_created", func(db *gorm.DB) {
+			if db.Error != nil {
+				return
+			}
+			lagoon.AfterCommit(db.Statement.Context, db, func(ctx context.Context, db *gorm.DB) {
+				// runs only once the insert is committed
+			})
+		})
+	})
+}
+
+func publish(ctx context.Context, gdb *gorm.DB, post *Post) error {
+	return lagoon.Transaction(ctx, gdb, func(ctx context.Context, tx *gorm.DB) error {
+		return tx.Create(post).Error // acme:post_created work waits for this commit
+	})
+}
+```
+
 A plugin ships its schema as an ordered gormigrate set; `migrate` runs it after the framework sets:
 
 ```go
@@ -87,7 +112,11 @@ func (p *Plugin) Migrations() []*gormigrate.Migration {
 | `lagoon.OpenFromApp` | Opens the shared pool from `database.dsn` and publishes the `app.key` encryption keys. |
 | `lagoon.Open` | Opens and pings a DSN, checks the locale and returns the pool plus a GORM handle on it. |
 | `lagoon.Use` | Returns a GORM handle on an existing pool after the same checks. |
-| `lagoon.Publish` | Stores the pool and GORM handle on the `backpack.App`. |
+| `lagoon.Publish` | Stores the pool and GORM handle on the `backpack.App`, then runs the callbacks queued by `lagoon.OnDatabase`. |
+| `lagoon.OnDatabase` | Runs a callback with the pool and GORM handle once the database is published. |
+| `lagoon.Transaction` | Runs a function in a transaction (a savepoint when nested) and its `lagoon.AfterCommit` callbacks after the commit. |
+| `lagoon.AfterCommit` | Registers work to run after the surrounding transaction commits. |
+| `lagoon.AfterCommitCallback` | Name of the GORM callback, `lagoon:after_commit`, that runs single-statement after-commit work. |
 | `lagoon.DSN` | Reads `database.dsn` from config. |
 | `lagoon.CheckLocale` | Fails unless the database default locale is ICU `pl-PL`. |
 | `lagoon.Migrate` | Runs framework and plugin migrations in order. |