feat(server): internal Atlas read-only database API

What

Adds read-only database endpoints under /api/internal/atlas/db, for Atlas’ MCP to consume:

• POST /api/internal/atlas/db/query — run a single read-only SQL statement
• GET /api/internal/atlas/db/tables — list app-owned tables (size + estimated rows)
• GET /api/internal/atlas/db/tables/:schema/:name — describe a table’s columns

How

Backed by Tuist.Ops.Database — the same read-only engine behind /ops/db: a SELECT/WITH/EXPLAIN/SHOW grammar gate, a BEGIN READ ONLY transaction, and a clamped statement_timeout. Reachable only by the Atlas service account through the existing InternalAtlasAuthPlug (workload identity / pinned JWKS) — the same :atlas_internal_api pipeline as the existing /api/internal/atlas/accounts/:handle/usage endpoint.

Adds Tuist.Ops.Database.to_json_map/1 for JSON-safe API responses (preserves column order + truncation metadata).

Companion

Atlas adds the executive-gated *_tuist_postgres* MCP tools that call these endpoints in tuist/atlas#344.

Tests

Controller test added, mirroring the existing AtlasUsageController test. I couldn’t get ExUnit to finish locally (the fresh worktree’s cold CLDR compile wedged), so relying on CI to validate.

🤖 Generated with Claude Code

No GitHub comments yet.