feat: implement metadata catalog database management

docker/catalog-db-init.sql

@@ -0,0 +1,25 @@
+DO $bootstrap$
+DECLARE
+  runtime_password text := trim(both E'\r\n' from pg_read_file('/run/secrets/catalog_runtime_password'));
+BEGIN
+  IF runtime_password = '' THEN
+    RAISE EXCEPTION 'catalog runtime password is empty';
+  END IF;
+
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_catalog.pg_roles WHERE rolname = 'thothii_catalog_runtime'
+  ) THEN
+    EXECUTE format(
+      'CREATE ROLE thothii_catalog_runtime LOGIN PASSWORD %L',
+      runtime_password
+    );
+  END IF;
+END
+$bootstrap$;
+
+GRANT CONNECT ON DATABASE thothii_catalog TO thothii_catalog_runtime;
+GRANT USAGE ON SCHEMA public TO thothii_catalog_runtime;
+ALTER DEFAULT PRIVILEGES IN SCHEMA public
+  GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO thothii_catalog_runtime;
+ALTER DEFAULT PRIVILEGES IN SCHEMA public
+  GRANT USAGE, SELECT ON SEQUENCES TO thothii_catalog_runtime;