feat(lanes): per-lane database, Redis, and .env isolation (A1+A2)

Gives each lane its own slot-derived runtime (ports, detached process
lifecycle, profile-driven hooks) and its own database/Redis logical
index/.env file, so two lanes running the same repo's stack at once no
longer share state. Machine-level DB/Redis credentials live at
~/.ccam/secrets.env (mode 0600, never returned by any route); a hook's
output is redacted of that password (raw and URL-encoded forms) before
it reaches a log file or the lane_hook_output websocket broadcast.
Wired into provision/up/reset/remove; reset accepts --keep-db to skip
the drop/recreate/migrate/reseed block entirely.

server/data/profile-templates/postgres-compose/profile.env.example

@@ -0,0 +1,23 @@
+# postgres-compose profile template — data-isolation additions (A2).
+# Copy the declarations you need into your repo's own .ccam/profile/profile.env
+# alongside db-create.sh / db-drop.sh from this template's hooks/ directory.
+
+DB_PREFIX="myapp_l"          # lane in slot 3 -> myapp_l3 ; empty = no per-lane DB
+DB_KIND="postgres"           # informational
+DB_URL_SCHEME="postgresql"   # DATABASE_URL scheme
+REDIS=1                      # 1 = allocate a logical Redis index = slot
+                              # (16 logical DBs by default, 0-15 — keep
+                              #  LANE_MAX_SLOTS <= 15 if you turn this on)
+
+ENV_FILES="backend/.env"                          # file(s) to seed, relative to the lane
+ENV_SOURCE="backend/.env"                         # source path in the source repo
+ENV_REWRITE="DATABASE_URL REDIS_URL UPLOAD_DIR"   # keys CCAM overwrites per lane
+ENV_PRESERVE="JWT_SECRET"                         # keys kept from the lane's OWN file on --force
+UPLOAD_SUBDIR="backend/data/uploads"              # exported as UPLOAD_DIR
+
+# Read by db-create.sh / db-drop.sh, NOT by CCAM itself:
+COMPOSE_FILE="docker-compose.yml"   # relative to the lane's working copy
+DB_SERVICE="postgres"               # the compose service name running Postgres
+
+# Machine-level credentials (PG_HOST/PORT/USER/PASS, REDIS_HOST/PORT) come
+# from ~/.ccam/secrets.env, never from here — see server/lib/secrets.js.