Prompt registry in Postgres

ADR-005 made prompts reviewable but coupled prompt fixes to the deploy train. Incident response needs prompt rollout (and rollback) in seconds, with the audit trail intact.

Prompts move to a registry in Postgres: prompts holds the key and active version pointer, prompt_versions is append-only. The API exposes the registry read-side under /admin/prompts; activating a version is one UPDATE, rollback is the same UPDATE backwards. Every version still lands in the repo as a migration for review.

Prompt rollout decoupled from deploys; the April-outage scenario becomes a sub-minute fix. The eval harness (ADR-008) records scores per (prompt_key, version), so regressions name the exact version that caused them.