WPB-22970: migrate activation-keys to PostGreSQL - #5417

Add Postgres, DualWrite, and Migration interpreters for the
ActivationCodeStore effect (brig service). The migration follows the
canonical dual-write + background-worker pattern:

- Layer A: PostgresMarshall instances for ActivationKey/ActivationCode
- Layer B: Postgres interpreter with TTL→expires_at conversion
- Layer C: DualWrite interpreter (reads→Cassandra, writes→both)
- Layer D: Migration loop copying ttl(code)→expires_at
- Layer E: activationKeys StorageLocation config field
- Layer F: Brig interpreter selection + second-writer refactor
- Layer G-H: Background-worker migration wrapper + flag
- Layer I-R: SQL migration, helm values, config docs, integration test

The key design decision: the second writer
(Brig.Data.Activation.verifyCode) that bypassed the effect is now routed
through a new VerifyActivationCode effect constructor. This preserves the
brute-force protection (3 max retries, TTL-preserving countdown, delete on
exhaustion) while allowing each interpreter to implement it natively.

ActivationCodeStore was moved before the Error block in
BrigLowerLevelEffects to ensure Error Hasql.UsageError is available when
the Postgres interpreter runs.

Bead: ws-migrate-postgresql-ec0

- rename activation_keys column "user" -> user_id and drop the redundant
  (key, expires_at) index (PK on key serves the lookup); regenerate
  postgres-schema.sql
- move verification logic out of the ActivationCodeStore effect into a new
  Wire.ActivationCodeVerificationStore effect over the store; the store keeps
  persistence only (LookupActivationKey / DecrementActivationRetries /
  DeleteActivationKey)
- add a nightly Arbiter cron job (activation-keys queue) that deletes expired
  activation key rows from Postgres in bounded batches; new required config
  background-worker.config.activationKeysCleanup.schedule (default 0 3 * * *)
- rewrite the integration test to drive the full lifecycle
  cassandra -> dual-write -> dual-write+worker -> postgresql, including retry
  convergence and brute-force exhaustion