refactor(data): migrate pgx connector stack from v4 to v5

[rguichard]

Resolves PLA-1392 (follow-up from PLA-1353; audit notes in docs/plans/2026-05-06-pgx-v5-migration.md).

Summary

Migrates the eRPC PostgreSQL connector stack from github.com/jackc/pgx/v4 to github.com/jackc/pgx/v5 (v5.10.0).

Changes

• go.mod / go.sum: pgx/v4 and the direct pgconn v1 dependency replaced by pgx/v5; the v1-era pgtype, pgio, and pgproto3/v2 indirects drop out, puddle/v2 comes in.
• data/postgresql.go:
  • Imports moved to github.com/jackc/pgx/v5, github.com/jackc/pgx/v5/pgxpool, and github.com/jackc/pgx/v5/pgconn (the audit missed that isPostgresConnectionError uses pgconn.PgError directly for SQLSTATE 08xxx matching).
  • Pool creation now goes through a new connectPostgreSQLPool helper: pgxpool.NewWithConfig + eager Ping. pgx v5 pools always connect lazily, but the connector's initializer/retry design (and the ErrConnectorNotReady sentinel) depends on pool construction failing fast when the server is unreachable. Without the ping, a reconnect after schema setup would publish a dead pool as ready. Used for the main pool, readonly replicas, and the listener pool.
  • err == pgx.ErrNoRows comparisons switched to errors.Is since v5 can wrap the sentinel.
• data/postgresql_iam_auth.go: import bump only — v5 keeps the func(ctx, *pgx.ConnConfig) error BeforeConnect hook shape, and User/Password are promoted from the embedded pgconn.Config.
• data/postgresql_test.go, auth/strategy_database_test.go: import bumps only.
• docs/plans/2026-05-06-pgx-v5-migration.md: marked implemented with an outcome section.

Testing

• go test ./data -run 'TestPostgre' -count=1 — all pass against real Postgres containers, including TestPostgreConnectorInitialization (both readiness cases — the invalid-address case exercises the lazy-connect concern directly) and all five TestPostgreSQLDistributedLocking advisory-lock scenarios.
• go test ./auth — classifyDbError / isDownSignal regression guards pass with v5 PgError values.
• Full make test-fast — green.

Risks

• pgx v5 changes internal pool behavior (health checks, puddle/v2); the eager-ping helper preserves the v4 startup contract, and the 2026-05-13 incident regression tests (TestIsPostgresConnectionError, coalescing/schema-gate tests) all pass unchanged.

---

Summary

The PostgreSQL connector and its supporting files relied on the v4 generation of the jackc/pgx library, along with a separate github.com/jackc/pgconn v1 direct dependency. This change upgrades the entire stack to github.com/jackc/pgx/v5 (v5.10.0) to eliminate the v1-era sub-packages, benefit from v5's API improvements, and shed a large cluster of transitive indirect dependencies.

A key behavioral difference required attention: unlike v4's pgxpool.ConnectConfig, the v5 equivalent (pgxpool.NewWithConfig) connects lazily and never fails at construction time. A new connectPostgreSQLPool helper wraps NewWithConfig with an eager Ping to preserve the fail-fast semantics that the initializer retry loop and the ErrConnectorNotReady sentinel rely on.

Changes

• go.mod / go.sum: replaced github.com/jackc/pgconn v1 and github.com/jackc/pgx/v4 direct dependencies with github.com/jackc/pgx/v5 v5.10.0; dropped v1-era transitives (chunkreader/v2, pgio, pgproto3/v2, pgtype, puddle v1, shopspring/decimal, lib/pq, cockroachdb/apd, gofrs/uuid); added puddle/v2 v2.2.2.
• data/postgresql.go: updated all imports from pgx/v4 and standalone pgconn to pgx/v5; replaced every call to pgxpool.ConnectConfig with the new connectPostgreSQLPool helper (covers the primary connect task, readonly replica pools, and the listener pool); switched two err == pgx.ErrNoRows equality checks to errors.Is to handle wrapped sentinels in v5.
• data/postgresql.go — connectPostgreSQLPool: new function that calls pgxpool.NewWithConfig then immediately Pings the server, closing the pool and propagating the error on failure. This restores the v4 eager-dial contract required by the initializer's retry and not-ready logic.
• data/postgresql_iam_auth.go: import bumped from pgx/v4 to pgx/v5; no logic changes needed (BeforeConnect hook shape and promoted User/Password fields are compatible).
• data/postgresql_test.go and auth/strategy_database_test.go: imports updated to pgx/v5 and pgx/v5/pgconn.
• docs/plans/2026-05-06-pgx-v5-migration.md: status updated to Implemented; implementation outcome section added documenting the corrections to the original audit and final validation results.

Testing

• Run the real-Postgres container tests to validate startup readiness in both the "server reachable" and "server unreachable" paths, and all advisory-lock scenarios:

  go test ./data -run 'TestPostgreConnectorInitialization' -count=1 -v
  go test ./data -run 'TestPostgreSQLDistributedLocking' -count=1 -v
  

• Run the full data and auth unit suites:

  go test ./data/... -count=1
  go test ./auth/... -count=1
  

• Confirm the full fast test suite passes:

  make test-fast
  

• Edge cases to exercise: pool reconnect after a schema setup completes (verifies the dead-pool guard), and RDS IAM token injection via the BeforeConnect hook with a mocked rdsutils token source.