feat: AI security controls + PostgreSQL hardening (Week 1 Quick Wins)

AI Security (EGAI 4.3.1.3, 4.3.1.4, 4.1.3.1, IAAI 3.6.26):
- AI Disclaimer banner in ChatPanel: "AI responses may be inaccurate"
- "AI Generated" violet badge on: chat messages, AI summaries,
  project narratives, AI-generated cover images
- HITL: system prompt now requires explicit user confirmation
  before any data mutation (strongly worded instruction)
- Mutation tool audit logging: all 31 write tools logged with
  tool name, params, userId, userRole via Pino

PostgreSQL Hardening (PG Standard V1.6):
- Audit logging: log_connections, log_disconnections, log_statement=ddl,
  log_min_duration_statement=1000 in docker-compose
- SUPERUSER removal script: scripts/harden-postgres.sh
  (NOSUPERUSER + minimal GRANT for app user)
- Health check: pg_isready -U capakraken -d capakraken
- Documentation: security-architecture.md Section 12 updated

Controls closed: EGAI 4.1.3.1, 4.3.1.3, 4.3.1.4, PG 3.3, 3.5

Co-Authored-By: claude-flow <ruv@ruv.net>

scripts/harden-postgres.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+# Remove SUPERUSER from the application database user
+# Run after initial setup: bash scripts/harden-postgres.sh
+
+CONTAINER="planarchy-postgres-1"  # Note: container name may still use old naming
+DB_USER="capakraken"
+DB_NAME="capakraken"
+
+echo "Hardening PostgreSQL for $DB_USER..."
+
+# Remove SUPERUSER privilege
+docker exec $CONTAINER psql -U postgres -c "ALTER USER $DB_USER NOSUPERUSER;"
+
+# Grant only needed permissions
+docker exec $CONTAINER psql -U postgres -d $DB_NAME -c "
+  GRANT CONNECT ON DATABASE $DB_NAME TO $DB_USER;
+  GRANT USAGE ON SCHEMA public TO $DB_USER;
+  GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO $DB_USER;
+  GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO $DB_USER;
+  ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO $DB_USER;
+  ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO $DB_USER;
+"
+
+echo "Done. $DB_USER no longer has SUPERUSER."