feat(replicas): auto-heal slave data drift and no-store public settings

Add sync-replica-data repair on deploy, a publisher-side replica watch
(60s + after tenant/settings writes), REFRESH PUBLICATION after migrate,
and Cache-Control no-store on program-settings and get_version.

Co-authored-by: Cursor <cursoragent@cursor.com>

deploy/replicas.env.example

@@ -3,6 +3,9 @@
 # One DSN per line (or comma). Do not put spaces between URLs.
 # Prefer URI form. Password must not contain @ : / # ? — or URL-encode it.
 # Keyword form (host=...) is OK only because the script splits on newlines, not spaces.
-# The user must be able to run ALTER TABLE (table owner or superuser).
+# The user must be able to run ALTER TABLE + ALTER SUBSCRIPTION + TRUNCATE on each replica.
 REPLICA_DSNS="postgresql://USER:PASSWORD@SLAVE_1_IP:5433/superadmin
 postgresql://USER:PASSWORD@SLAVE_2_IP:5432/superadmin"
+
+# Read-only app user on replicas (program-settings API). Grants re-applied after data repair.
+# REPLICA_APP_DB_USER=montime