Pass verification role to migrations

[madebygps]

Summary

• add migration 0039 to reapply the narrow requirements column grant for the verification Functions database role
• pass verification_functions_postgres_role from Terraform outputs into the migration job environment
• set POSTGRES_VERIFICATION_FUNCTIONS_ROLE in CI migration checks so missing env is caught before deploy

Why

Migration 0038 was already stamped as applied, but the deploy job did not pass POSTGRES_VERIFICATION_FUNCTIONS_ROLE when starting the Container Apps job. That made 0038 a safe no-op, so dev kept failing with permission denied on requirements.

Validation

• cd api && uv run ruff check . ../packages/learn-to-cloud-shared
• cd api && uv run ruff format --check . ../packages/learn-to-cloud-shared
• cd api && uv run ty check --exclude scripts --exclude tests .
• cd packages/learn-to-cloud-shared && uv run ty check --exclude tests .
• cd apps/verification-functions && uv run ruff check . && uv run ruff format --check . && uv run ty check . && uv run python -c "import function_app"
• cd api && uv run pytest tests/ -x
• cd packages/learn-to-cloud-shared && uv run pytest tests/ -x
• env -i HOME=$HOME PATH=$PATH DATABASE__URL=postgresql+asyncpg://postgres:postgres@db:5432/learntocloud POSTGRES_VERIFICATION_FUNCTIONS_ROLE=ltc_verification_functions_dev uv run alembic upgrade head
• API smoke checks for /health, /ready, and /openapi.json