feat(usable): integrate current dbtool implementation snapshot

Co-Authored-By: Paperclip <noreply@paperclip.ing>

examples/README.md

@@ -27,6 +27,12 @@ These assets give backend, frontend, and QA one small shared dataset for Postgre
 - `examples/fixtures/mysql/init.sql` 会显式授予 `dbtool` 用户对 `qa_demo` 的权限
 - 这样可避免 demo 容器默认库名与 QA 目标库名不一致时，`dbtool` 无法访问 `qa_demo`
 
+## PostgreSQL Bootstrap Note
+
+- `docker-compose.demo.yml` 与 `scripts/tui/demo-stack.sh` 现在保留 `postgres` 作为 demo 超级用户，密码为 `dbtoolroot`
+- `examples/fixtures/postgres/init.sql` 会把 `dbtool` 收敛为 `NOSUPERUSER` 的 app 用户，并只授予 `dbtool_demo.qa_demo` 的读权限
+- 若容器是在旧配置（`POSTGRES_USER=dbtool`）下初始化的，需要先 `docker compose -f docker-compose.demo.yml down -v` 或 `scripts/tui/demo-stack.sh reset` 再重建，否则旧卷里的超级权限不会自动消失
+
 ## SQLite Bootstrap Note
 
 - `examples/scripts/bootstrap-sqlite.sh` 现支持 `sqlite3`、`node:sqlite` 或 `python3 sqlite3` 三种 seed 路径

examples/fixtures/postgres/init.sql

@@ -1,5 +1,31 @@
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'dbtool') THEN
+    CREATE ROLE dbtool
+      LOGIN
+      PASSWORD 'dbtool'
+      NOSUPERUSER
+      NOCREATEDB
+      NOCREATEROLE
+      INHERIT;
+  ELSE
+    ALTER ROLE dbtool
+      WITH LOGIN
+      PASSWORD 'dbtool'
+      NOSUPERUSER
+      NOCREATEDB
+      NOCREATEROLE
+      INHERIT;
+  END IF;
+END
+$$;
+
+GRANT CONNECT ON DATABASE dbtool_demo TO dbtool;
+
 DROP SCHEMA IF EXISTS qa_demo CASCADE;
-CREATE SCHEMA qa_demo;
+CREATE SCHEMA qa_demo AUTHORIZATION postgres;
+GRANT USAGE ON SCHEMA qa_demo TO dbtool;
+ALTER ROLE dbtool IN DATABASE dbtool_demo SET search_path TO qa_demo, public;
 SET search_path TO qa_demo;
 
 CREATE TABLE accounts (
@@ -30,3 +56,6 @@ INSERT INTO tickets (id, account_id, title, status, notes, amount_cents, created
   (102, 1, 'csv export mismatch', 'closed', 'fixed after re-run', 1500, '2026-03-21T11:15:00Z'),
   (103, 2, '权限验证', 'open', 'needs DBA review', 300, '2026-03-22T15:30:00Z'),
   (104, 3, 'emoji smoke 😀', 'open', NULL, 42, '2026-03-23T07:05:00Z');
+
+GRANT SELECT ON ALL TABLES IN SCHEMA qa_demo TO dbtool;
+ALTER DEFAULT PRIVILEGES IN SCHEMA qa_demo GRANT SELECT ON TABLES TO dbtool;

examples/scripts/bootstrap-postgres.sh

@@ -5,7 +5,7 @@ ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 COMPOSE_FILE="${COMPOSE_FILE:-$ROOT_DIR/docker-compose.demo.yml}"
 SERVICE_NAME="${POSTGRES_SERVICE_NAME:-postgres}"
 CONTAINER_NAME="${POSTGRES_CONTAINER_NAME:-dbtool-cli-v1-postgres-1}"
-POSTGRES_USER="${POSTGRES_USER:-dbtool}"
+POSTGRES_USER="${POSTGRES_USER:-postgres}"
 POSTGRES_DB="${POSTGRES_DB:-dbtool_demo}"
 
 if docker compose version >/dev/null 2>&1; then