Project repo_url: worker can run tasks from any git repo

Projects gain repo_url (validated: https:// or git@ only, no
userinfo/password, no file:// or local paths; old DBs get the
column via idempotent ALTER in both SQLite and Postgres init).
Worker resolves a project's repo_url to a local checkout under
--repos-dir (default ./repos) before dispatch: clone if absent,
verify remote origin matches and fetch if present, never force
reset/clean, never push (push needs write credentials the
control plane does not store). Resolve failure fails the task
with a clear error, never completed. Docker workers need
repos_dir under a same-path extra mount (e.g.
/var/lib/codex-app-server/repos).
Also: driver-missing test is now mocked instead of depending
on the host really having no psycopg driver installed.
Deploy package: Caddyfile template exposing only /webhooks/*
and /oauth/* (tasks/projects/admin stay 403) plus a
webhook-secret generator script that never prints the secret.
Tests: host 27 pass, cloud 286 pass (8 skipped are
environment-dependent real-Postgres tests).

cloud/tests/test_postgres_backend.py

@@ -288,7 +288,13 @@ class SchemaStatementTestCase(unittest.TestCase):
         conn = db.connect()
         init_postgres_schema(conn)
         executed = [sql for sql, _ in fake.conn.cursor_obj.executed]
-        self.assertEqual(len(executed), len(POSTGRES_SCHEMA))
+        # 改动理由：init_postgres_schema 现在还要给老库 projects 表补
+        # repo_url 列（PRAGMA 查列 + ALTER TABLE），所以执行语句数
+        # 不再精确等于 schema 语句数；断言改为“schema 语句全部执行
+        # 且补列语句也执行”，不放宽 schema 本身的覆盖要求。
+        for stmt in POSTGRES_SCHEMA:
+            self.assertIn(stmt, executed)
+        self.assertTrue(any("repo_url" in sql for sql in executed))
         self.assertTrue(fake.conn.committed)