change database and add users table schema - #1

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docker-compose.yml`:
- Around line 3-5: The Postgres service is mounting db_data to the wrong data
directory, so the named volume is not being used by postgres:18.4-alpine3.24.
Update the volume mapping in the docker-compose service to target Postgres 18’s
actual data path under /var/lib/postgresql/18/docker, using the existing db_data
volume entry so the container persists state correctly.

In `@README.md`:
- Line 2: The TECH STACK entry in the README still lists MariaDB, which
conflicts with the PostgreSQL migration in this PR. Update the README’s database
value to PostgreSQL so the documented stack matches the actual implementation
and keep the change limited to the existing TECH STACK entry.

In `@sql/schema/001_users.sql`:
- Line 7: The users table definition currently leaves r_id nullable and
unconstrained, so duplicate external IDs can slip in and SelectUserByRID may
return an arbitrary row. Update the schema in the users table DDL to make r_id
NOT NULL and add a UNIQUE constraint (or unique index) on r_id, keeping the
change localized to the column definition used by the user lookup flow.
- Around line 2-9: The users table definition uses a plain integer primary key
for users.id, which requires callers to supply values manually. Update the users
schema so the id column uses an identity-generated primary key in the create
table users statement, keeping the rest of the columns unchanged and ensuring
inserts can omit id safely.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@internal/auth/jwt.go`:
- Around line 45-50: `ParseWithClaims` is being called with
`jwt.RegisteredClaims` by value in `jwt.ParseWithClaims`, which prevents the
claims from being populated correctly. Update the token parsing in the auth JWT
flow to pass a pointer to `jwt.RegisteredClaims` (for example via a named claims
variable) and then read the subject from that parsed claims instance instead of
the zero-value copy.