feat(harness): persist server sessions in postgres

harness/tht/config.py

@@ -78,6 +78,22 @@ class DatabaseConfig(BaseModel):
     model_config = {"populate_by_name": True}
 
 
+class SessionPostgresConfig(DatabaseConfig):
+    """TLS-verified direct session storage; its login must be granted thoth_sessions_runtime.
+
+    Provision the dedicated LOGIN role and membership out of band so deployment credentials
+    never appear in the versioned migration pack.
+    """
+
+    sslmode: Literal["verify-ca", "verify-full"] = "verify-full"
+    sslrootcert: Path | None = None
+
+
+class SessionStorageConfig(BaseModel):
+    type: Literal["postgres_direct"]
+    connection: SessionPostgresConfig
+
+
 class RestConfig(BaseModel):
     """Accesso al DWH via Supabase/PostgREST. base_url es. https://host/dwh/ ."""
 
@@ -292,6 +308,7 @@ class Config(BaseModel):
     _config_source: str = PrivateAttr(default="direct")
     dwh: DwhResourceConfig
     vectors: VectorResourceConfig | None = None
+    session_storage: SessionStorageConfig | None = None
     roots: WorkspaceRoots = WorkspaceRoots()
     # Compatibility views retained until all call sites consume typed resources.
     database: DatabaseConfig