Keep the engine's state in SQLite, not Postgres

One process owns this database — the image has run a single uvicorn
worker for that reason since the four-engines bug — so a file beside the
flows is the honest shape for it, and it is what lets `fluksio serve`
need no infrastructure at all. Live values, node execution and the work
queue never came here anyway; what does is a rollup a minute at a time,
a row per cascade and the run history, and WAL keeps the readers going
while that one writer works.

DATA_DIR is now the one setting that moves everything an installation
keeps; the rest derive from it and the images still spell theirs out.
The schema is prepared in-process at startup, so the prestart service is
gone, and the ten Postgres-only revisions collapse into one portable
baseline.

Three things only worked because psycopg was casting for us: a token's
subject arriving as a string where the column is a UUID, `greatest`, and
`date_bin`. The timestamps needed a column type of their own — SQLite
stores no offset, and a naive datetime read back either raises against an
aware `now` or serialises as local time.

Postgres stays in the stack only for Umami, behind the analytics profile.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.env.example

@@ -31,9 +31,15 @@ SMTP_TLS=True
 SMTP_SSL=False
 SMTP_PORT=587
 
-# Postgres
-POSTGRES_SERVER=localhost
-POSTGRES_PORT=5432
+# Where this installation keeps everything: the database, flows, secrets,
+# artifacts and the user venv. The compose stack sets it to the /data volume.
+DATA_DIR=flow-data
+# Any SQLAlchemy URL. Empty means SQLite in the data directory, which is what
+# the engine is designed around — one process owns this database.
+DATABASE_URL=
+
+# The Postgres the optional Umami analytics profile runs on. Nothing else uses
+# it; `make umami` provisions a least-privilege role inside it.
 POSTGRES_DB=app
 POSTGRES_USER=postgres
 POSTGRES_PASSWORD=changethis