feat: use postgres

lobby/docs/runtime.md

@@ -56,9 +56,10 @@ flowchart LR
 
 Notes:
 
-- `cmd/lobby` refuses startup when Redis connectivity is misconfigured. User
-  Service and Game Master reachability are not verified at boot; transport
-  failures surface as request errors.
+- `cmd/lobby` refuses startup when Redis connectivity is misconfigured, when
+  PostgreSQL is unreachable, or when the embedded goose migrations fail to
+  apply. User Service and Game Master reachability are not verified at boot;
+  transport failures surface as request errors.
 - Both HTTP listeners expose `/healthz` and `/readyz` independently so health
   checks can target either port.
 - `register-runtime` is an outgoing call from Lobby to Game Master after the
@@ -85,7 +86,7 @@ Probe routes:
 
 - `GET /healthz` returns `{"status":"ok"}`
 - `GET /readyz` returns `{"status":"ready"}` once startup wiring completes.
-- Neither probe performs a live Redis ping per request.
+- Neither probe performs a live Redis or PostgreSQL ping per request.
 - There is no `/metrics` route. Metrics flow through OpenTelemetry exporters.
 
 ## Background Workers
@@ -130,13 +131,20 @@ lags or stalls, the gauge climbs and stays high.
 The full env-var list with defaults lives in `../README.md` §Configuration.
 The groups below summarize the structure:
 
-- **Required** — `LOBBY_REDIS_ADDR`, `LOBBY_USER_SERVICE_BASE_URL`,
+- **Required** — `LOBBY_REDIS_MASTER_ADDR`, `LOBBY_REDIS_PASSWORD`,
+  `LOBBY_POSTGRES_PRIMARY_DSN`, `LOBBY_USER_SERVICE_BASE_URL`,
   `LOBBY_GM_BASE_URL`.
 - **Process and logging** — `LOBBY_SHUTDOWN_TIMEOUT`, `LOBBY_LOG_LEVEL`.
 - **HTTP listeners** — `LOBBY_PUBLIC_HTTP_*`, `LOBBY_INTERNAL_HTTP_*`.
-- **Redis connectivity** — `LOBBY_REDIS_USERNAME`, `LOBBY_REDIS_PASSWORD`,
-  `LOBBY_REDIS_DB`, `LOBBY_REDIS_TLS_ENABLED`,
-  `LOBBY_REDIS_OPERATION_TIMEOUT`.
+- **Redis connectivity** — `LOBBY_REDIS_MASTER_ADDR`,
+  `LOBBY_REDIS_REPLICA_ADDRS`, `LOBBY_REDIS_PASSWORD`, `LOBBY_REDIS_DB`,
+  `LOBBY_REDIS_OPERATION_TIMEOUT` (legacy `LOBBY_REDIS_ADDR`,
+  `LOBBY_REDIS_TLS_ENABLED`, `LOBBY_REDIS_USERNAME` removed in PG_PLAN.md
+  §6A).
+- **PostgreSQL connectivity** — `LOBBY_POSTGRES_PRIMARY_DSN`,
+  `LOBBY_POSTGRES_REPLICA_DSNS`, `LOBBY_POSTGRES_OPERATION_TIMEOUT`,
+  `LOBBY_POSTGRES_MAX_OPEN_CONNS`, `LOBBY_POSTGRES_MAX_IDLE_CONNS`,
+  `LOBBY_POSTGRES_CONN_MAX_LIFETIME`.
 - **Streams** — `LOBBY_GM_EVENTS_STREAM`, `LOBBY_RUNTIME_START_JOBS_STREAM`,
   `LOBBY_RUNTIME_STOP_JOBS_STREAM`, `LOBBY_RUNTIME_JOB_RESULTS_STREAM`,
   `LOBBY_NOTIFICATION_INTENTS_STREAM`, `LOBBY_USER_LIFECYCLE_STREAM`.
@@ -152,9 +160,9 @@ The groups below summarize the structure:
 
 - `Game Lobby` owns platform game state. Game Master may cache snapshots but
   is not the source of truth.
-- The Race Name Directory ships a Redis adapter and an in-process stub; the
-  stub is intended for unit tests and is selected via
-  `LOBBY_RACE_NAME_DIRECTORY_BACKEND=stub`.
+- The Race Name Directory ships a PostgreSQL adapter (default after
+  PG_PLAN.md §6B) and an in-process stub. The stub is intended for unit
+  tests and is selected via `LOBBY_RACE_NAME_DIRECTORY_BACKEND=stub`.
 - A `permanent_block` or `deleted` event from User Service fans out
   asynchronously through the `user:lifecycle_events` consumer; in-flight
   games owned by the affected user receive a stop-job and transition to