ci.yml gains a postgres:16 service; alembic upgrade/downgrade/upgrade round-trip runs on PG, unit tests run -m "not integration", and the roles.sql integration suite runs with a postgresql-client install. (Gate executed locally against Postgres 18.6 — see PR description.)