Switch to timescaledb-ha image; enable PostGIS in migration

Migration 0001_positions.sql now runs CREATE EXTENSION IF NOT EXISTS
postgis alongside timescaledb. PostGIS isn't used in Phase 1 but enabling
it now means Phase 2's geofence engine doesn't need a separate migration
step. The deploy stack uses the timescale/timescaledb-ha:*-all image
which ships both extensions.

Integration test (pipeline.integration.test.ts) updated to use the same
timescale/timescaledb-ha:pg16.6-ts2.17.2-all image as the deploy stack.
Stock POSTGRES_USER/PASSWORD/DB env vars retained — if recent ha-image
revisions don't accept them, the test container will fail clearly on
first run with Docker, and we'll switch to the right env-var scheme.

src/db/migrations/0001_positions.sql

@@ -6,8 +6,17 @@
 -- writes to (timing_records, stage_results, etc.) are defined in Directus.
 -- Do NOT modify this table from the Directus admin UI.
 
--- Enable TimescaleDB extension (no-op if already installed at the DB level).
+-- Enable required Postgres extensions. No-ops if already installed at the
+-- DB level. The deploy stack uses the `timescale/timescaledb-ha:*-all`
+-- image which ships TimescaleDB and PostGIS binaries — these CREATE
+-- EXTENSION statements just register them on this database.
+--
+-- TimescaleDB: hypertable partitioning for the positions table below.
+-- PostGIS: not used in Phase 1, but enabled now so Phase 2's geofence
+-- engine doesn't need a separate migration step. Geometry columns will
+-- be added by the Directus-owned migrations for the geofences table.
 CREATE EXTENSION IF NOT EXISTS timescaledb;
+CREATE EXTENSION IF NOT EXISTS postgis;
 
 -- Raw position history. High-volume append-only table; the hypertable
 -- partitioning column is `ts` (device-reported GPS time).