Implement hosted Phase/Extension Registry (WP-0006-T03)

Adds migrations/0001_registries.sql (licensors, phase_manifests,
extensions tables; trf_app role with no UPDATE/DELETE grant on either
table, canonicalization only via a SECURITY DEFINER function), and
src/target_revenue/registry.py + service/app.py: a thin FastAPI layer
wrapping the existing validation.py checks with persistence and
per-Licensor token auth, adding no new validation logic per ADR-0002.
New optional service/service-dev dependency groups keep the core
offline library dependency-free. tests/test_registry_hosting.py (7
tests, Docker-gated, auto-skip otherwise) spins an ephemeral disposable
Postgres container and verifies registration, rejection, duplicate/
unknown-token handling, extension canonicalization, and two explicit
database-privilege checks that the app role cannot bypass the
append-only/governance-gated guarantees.

pyproject.toml

@@ -18,6 +18,16 @@ dependencies = [
 dev = [
     "pytest>=8.0",
 ]
+service = [
+    "psycopg[binary]>=3.1",
+    "psycopg-pool>=3.1",
+    "fastapi>=0.110",
+    "uvicorn>=0.27",
+]
+service-dev = [
+    "target-revenue[service,dev]",
+    "httpx>=0.27",
+]
 
 [tool.hatch.build.targets.wheel]
 packages = ["src/target_revenue"]