Add PostgreSQL read-only replica support

[binwiederhier]

Summary

• Add db.DB wrapper that supports routing read queries to PostgreSQL read replicas via round-robin with automatic health checking and fallback to primary
• Introduce Beginner interface so ExecTx/QueryTx work with both *sql.DB and *db.DB
• Route read-heavy queries in message cache, user manager, and web push store to replicas via ReadOnly()
• New --database-replica-urls flag (opt-in, no behavior change when unconfigured)

Configuration

database-replica-urls:
  - postgres://user:pass@replica1:5432/ntfy
  - postgres://user:pass@replica2:5432/ntfy

Design

• db.DB wraps a primary *sql.DB and optional replicas
• ReadOnly() returns a *sql.DB from a healthy replica (round-robin) or falls back to primary
• Replicas are health-checked via ping every 5 seconds (cached with atomic CAS)
• All writes, transactions, and correctness-critical reads stay on primary
• SQLite stores are unaffected (wrapped with db.NewDB(sqlDB, nil) for uniform typing)

Test plan

• go test ./... passes (all existing tests, no replicas = ReadOnly returns primary)
• Manual test with PG primary + streaming replica
• Verify writes never route to replicas
• Verify automatic fallback when replica is down