docs(cli): clarify role SQL template

- Add example ROLE_STMT expansions to cli/sql/01.role.sql

fix(cli): improve init error output

- Avoid blank init failure messages; show code/detail/hint when available

- Add regression test ensuring missing-connection error includes examples

fix(cli): create/alter role password must be literal

- Inline safely quoted password for CREATE/ALTER USER (bind params not allowed)

- Add regression test

fix(cli): validate init port option

- Reject non-numeric or out-of-range ports for psql-like -p/--port

- Add unit test for invalid port

test(cli): fix Postgres socket port in integration tests

- Pass the chosen port for unix-socket connections (pg defaults to 5432 otherwise)

ci: keep cli publish job available in web pipelines

- Re-add unconditional manual rule for web-triggered pipelines to avoid empty pipeline

ci: auto-publish cli for version tags

- Run cli:npm:publish automatically for tag-like refs, including web-triggered pipelines

ci: allow manual cli publish from web pipelines

- Expose cli:npm:publish as manual job for Run pipeline UI

- Keep tag-based auto publish for matching CI_COMMIT_TAG

ci: allow publish job in web tag pipelines

- Use CI_COMMIT_REF_NAME when CI_COMMIT_TAG is not set

- Include rule for web-triggered pipelines on tag refs

fix(cli): always close pg client in init

- Ensure client.end() runs even when init fails after connect