feat(replicas): auto-heal slave data drift and no-store public settings

Add sync-replica-data repair on deploy, a publisher-side replica watch
(60s + after tenant/settings writes), REFRESH PUBLICATION after migrate,
and Cache-Control no-store on program-settings and get_version.

Co-authored-by: Cursor <cursoragent@cursor.com>

deploy/sync-replica-schema.sh

@@ -181,6 +181,30 @@ echo "== publisher"
 cd "$API_DIR"
 npx prisma migrate deploy
 
+refresh_subscriptions() {
+  local dsn="$1"
+  mapfile -t subs < <(
+    run_psql "$(libpq_dsn "$dsn")" -v ON_ERROR_STOP=1 -At -c \
+      "SELECT subname FROM pg_subscription ORDER BY subname"
+  )
+  if ((${#subs[@]} == 0)); then
+    echo "  ! no subscription — skip REFRESH PUBLICATION"
+    return 0
+  fi
+  for sub in "${subs[@]}"; do
+    echo "  ALTER SUBSCRIPTION $sub REFRESH PUBLICATION (copy_data)"
+    # New tables added to FOR ALL TABLES are NOT replicated until this runs.
+    run_psql "$(libpq_dsn "$dsn")" -v ON_ERROR_STOP=1 -q \
+      -c "ALTER SUBSCRIPTION \"${sub}\" REFRESH PUBLICATION WITH (copy_data = true)"
+  done
+}
+
+echo "== refresh subscriptions (pick up new tables)"
+for dsn in "${REPLICAS[@]}"; do
+  echo "== $(label "$dsn")"
+  refresh_subscriptions "$dsn"
+done
+
 echo
 echo "Replicas apply DDL first, so the publisher can stream the new columns right away."
 echo "Verify with: bash deploy/sync-replica-schema.sh --check"