Add ReadOnlyDatabaseRole model

[kiwitcms-bot]

What

Adds a new ReadOnlyDatabaseRole model (standalone; the integration that creates the role for tenants comes in a follow-up PR).

Fields: name, created_at, valid_until, password.

ReadOnlyDatabaseRole.create_for_schema(schema_name, valid_until):

• name = ro_for_<schema_name> (READ_ONLY_ROLE_PREFIX is a class attribute)
• password = random UUID
• created_at = now
• valid_until = passed in by the caller

It stores the model record and creates an actual PostgreSQL role via raw SQL, escaping identifiers and values with psycopg's sql.Identifier / sql.Literal (no string interpolation), so user supplied values can't be used for SQL injection.

The role is created with LOGIN + ENCRYPTED PASSWORD + VALID UNTIL, gets USAGE on the tenant schema, SELECT on all tables in it, and ALTER DEFAULT PRIVILEGES ... GRANT SELECT ON TABLES so tables created later are covered too. No write privileges are granted.

All statements are sent in a single cursor.execute() call (PostgreSQL runs a multi-statement simple query in one implicit transaction), and the model row + DB role are created inside one transaction.atomic() block, so a failure leaves neither a stale row nor a partially-granted role. update_valid_until() updates the model and the DB role in one transaction.

Tests

tests/test_read_only_database_role.py: the record is stored, the actual DB role exists with rolvaliduntil, and has_table_privilege() reports SELECT but not INSERT/UPDATE/DELETE; plus update_valid_until().

black, flake8 and pylint (10.00/10) are clean; makemigrations --check reports no pending changes.