fix(db-tool): prevent fd leak from logger to long-running daemons

The hectic logger opens fd 3 as a dup of stderr. Child processes inherit
this fd, and daemonized PostgreSQL/PostgREST keeping it open prevents the
terminal from returning to the prompt after the spawning script exits.

- Add with_closed_fds helper that runs commands in a subshell with fds
  3-9 redirected to /dev/null
- Inline the helper into both database and postgres-init builds
- Wrap pg_ctl start and postgrest with the helper

legacy/helper/posix-shell/with_closed_fds.sh

@@ -0,0 +1,22 @@
+#!/bin/dash
+
+# with_closed_fds -- run command with leaked file descriptors closed
+#
+# Shell libraries (e.g. hectic logger) may open extra file descriptors
+# (like fd 3 as a dup of stderr). Child processes inherit these fds.
+# Long-running daemons (postgres, postgrest) that keep fd 3 open can
+# prevent the terminal from returning to the prompt even after the
+# spawning script exits.
+#
+# Usage:
+#   with_closed_fds pg_ctl -D "$data" -w start
+#   with_closed_fds postgrest "$config" > "$log" 2>&1 &
+#
+# Runs the command in a subshell where fds 3-9 are redirected to
+# /dev/null. The parent shell's fd table is untouched.
+with_closed_fds() {
+    (
+        exec 3>/dev/null 4>/dev/null 5>/dev/null 6>/dev/null 7>/dev/null 8>/dev/null 9>/dev/null
+        "$@"
+    )
+}