Project repo_url: worker can run tasks from any git repo

Projects gain repo_url (validated: https:// or git@ only, no
userinfo/password, no file:// or local paths; old DBs get the
column via idempotent ALTER in both SQLite and Postgres init).
Worker resolves a project's repo_url to a local checkout under
--repos-dir (default ./repos) before dispatch: clone if absent,
verify remote origin matches and fetch if present, never force
reset/clean, never push (push needs write credentials the
control plane does not store). Resolve failure fails the task
with a clear error, never completed. Docker workers need
repos_dir under a same-path extra mount (e.g.
/var/lib/codex-app-server/repos).
Also: driver-missing test is now mocked instead of depending
on the host really having no psycopg driver installed.
Deploy package: Caddyfile template exposing only /webhooks/*
and /oauth/* (tasks/projects/admin stay 403) plus a
webhook-secret generator script that never prints the secret.
Tests: host 27 pass, cloud 286 pass (8 skipped are
environment-dependent real-Postgres tests).

cloud/db.py

@@ -780,7 +780,8 @@ POSTGRES_SCHEMA = (
     "id TEXT PRIMARY KEY, "
     "name TEXT, "
     "owner_id TEXT, "
-    "created_at DOUBLE PRECISION)",
+    "created_at DOUBLE PRECISION, "
+    "repo_url TEXT)",
     # tasks 含 server.migrate_tasks_table 补的那 6 列，建表时一次建齐；
     # 老库迁移仍走 migrate_tasks_table（PRAGMA 翻译后在 PG 上是 no-op）。
     "CREATE TABLE IF NOT EXISTS tasks("
@@ -861,9 +862,19 @@ def init_postgres_schema(conn):
     conn 须是 PgConnection（或具同名 execute/commit 的适配连接）；
     SQLite 连接传进来会在首条 DDL 的 IDENTITY 语法上报错——
     调用方须按后端选对连接，不要把 SQLite 连接混进来。
+
+    建表后还给老库 projects 表补 repo_url 列（新库建表时已含）：
+    PRAGMA table_info 经适配层翻译成 information_schema 查询，
+    调用方取 row[1] 即列名；缺列时 ALTER TABLE 补列，已迁移的
+    库是 no-op。server.init_db 的 Postgres 分支还会再跑一次
+    migrate_projects_table，两次补列互不冲突（第二次是 no-op）。
     """
     for statement in POSTGRES_SCHEMA:
         conn.execute(statement)
+    cols = {row[1] for row in conn.execute(
+        "PRAGMA table_info(projects)").fetchall()}
+    if "repo_url" not in cols:
+        conn.execute("ALTER TABLE projects ADD COLUMN repo_url TEXT")
     conn.commit()