feat: implement metadata catalog database management

compose.yaml

@@ -25,6 +25,11 @@ services:
       THT_PI_AUTH_FILE: /home/thoth/.pi/agent/auth.json
       THT_AUTH_CONFIG_FILE: /run/thothii-auth/auth.yaml
       THT_AUTH_STATE_ROOT: /data/auth
+      THT_CATALOG_DB_HOST: catalog-db
+      THT_CATALOG_DB_PORT: "5432"
+      THT_CATALOG_DB_NAME: thothii_catalog
+      THT_CATALOG_RUNTIME_USER: thothii_catalog_runtime
+      THT_CATALOG_RUNTIME_PASSWORD_FILE: /run/secrets/catalog_runtime_password
       THT_DB_NAME: ${THT_DB_NAME:-}
       THT_DWH_REST_URL: ${THT_DWH_REST_URL:-}
       THT_LLM_URL: ${THT_LLM_URL:-}
@@ -47,6 +52,7 @@ services:
     secrets:
       - source: thothii_secrets
         target: thothii.secrets
+      - catalog_runtime_password
     healthcheck:
       test: ["CMD", "curl", "-fsS", "http://127.0.0.1:8787/health"]
       interval: 15s
@@ -54,6 +60,8 @@ services:
       retries: 5
       start_period: 30s
     depends_on:
+      catalog-db:
+        condition: service_healthy
       qdrant:
         condition: service_healthy
       embedding-model-init:
@@ -61,6 +69,51 @@ services:
     networks:
       - thothii
 
+  catalog-db:
+    image: postgres:17.6-bookworm@sha256:f3bd19c606e442c3d7bdfa8002e03fe260a1023351e0ea4598032022b68dd6e3
+    environment:
+      POSTGRES_DB: thothii_catalog
+      POSTGRES_USER: thothii_catalog_migrate
+      POSTGRES_PASSWORD_FILE: /run/secrets/catalog_migrator_password
+    volumes:
+      - catalog-data:/var/lib/postgresql/data
+      - ./docker/catalog-db-init.sql:/docker-entrypoint-initdb.d/010-runtime-role.sql:ro
+    secrets:
+      - catalog_runtime_password
+      - catalog_migrator_password
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - >-
+          pg_isready -U thothii_catalog_migrate -d thothii_catalog
+          && test "$(psql -U thothii_catalog_migrate -d thothii_catalog -Atqc
+          "select count(*) from pg_catalog.pg_roles where rolname = 'thothii_catalog_runtime'")" = "1"
+      interval: 5s
+      timeout: 3s
+      retries: 12
+      start_period: 10s
+    networks:
+      - thothii
+
+  catalog-migrate:
+    image: thothii-core:local
+    profiles: [catalog-maintenance]
+    pull_policy: never
+    command: ["node", "/app/backend/dist/catalog/migrate.js"]
+    environment:
+      THT_CATALOG_DB_HOST: catalog-db
+      THT_CATALOG_DB_PORT: "5432"
+      THT_CATALOG_DB_NAME: thothii_catalog
+      THT_CATALOG_MIGRATOR_USER: thothii_catalog_migrate
+      THT_CATALOG_MIGRATOR_PASSWORD_FILE: /run/secrets/catalog_migrator_password
+    secrets:
+      - catalog_migrator_password
+    depends_on:
+      catalog-db:
+        condition: service_healthy
+    networks:
+      - thothii
+
   workspace-maintenance:
     image: thothii-core:local
     profiles: [workspace-maintenance]
@@ -209,7 +262,12 @@ volumes:
   qdrant-data:
   embedding-models:
   auth-state:
+  catalog-data:
 
 secrets:
   thothii_secrets:
     file: "${THT_SECRETS_FILE:?set THT_SECRETS_FILE}"
+  catalog_runtime_password:
+    file: "${THT_CATALOG_RUNTIME_PASSWORD_SOURCE:-./deploy/secrets/catalog-runtime-password}"
+  catalog_migrator_password:
+    file: "${THT_CATALOG_MIGRATOR_PASSWORD_SOURCE:-./deploy/secrets/catalog-migrator-password}"