fix(db-tool): prevent fd leak from logger to long-running daemons

The hectic logger opens fd 3 as a dup of stderr. Child processes inherit
this fd, and daemonized PostgreSQL/PostgREST keeping it open prevents the
terminal from returning to the prompt after the spawning script exits.

- Add with_closed_fds helper that runs commands in a subshell with fds
  3-9 redirected to /dev/null
- Inline the helper into both database and postgres-init builds
- Wrap pg_ctl start and postgrest with the helper

package/db-tool/default.nix

@@ -43,6 +43,7 @@ let
         ${builtins.readFile hectic.helpers.posix-shell.change_namespace}
         ${builtins.readFile hectic.helpers.posix-shell.quote}
         ${builtins.readFile hectic.helpers.posix-shell.pager_or_cat}
+        ${builtins.readFile hectic.helpers.posix-shell.with_closed_fds}
         ${hecticEnv}
         ${applyBundle}
         ${builtins.readFile ./database.sh}
@@ -62,7 +63,11 @@ let
       name = "postgres-init";
       runtimeInputs = [ postgresql coreutils ];
 
-      text = builtins.readFile ./postgres-init.sh;
+      text = ''
+        ${builtins.readFile hectic.helpers.posix-shell.with_closed_fds}
+        ${builtins.readFile ./postgres-init.sh}
+      '';
+
 
       meta = {
         description = "Initialize local PostgreSQL instance";

package/db-tool/postgres-init.sh

@@ -36,7 +36,7 @@ postgres_init_main() {
   sed -i '/^[[:space:]]*port[[:space:]]*=/d' "$data/postgresql.conf" || return 1
   sed -i '/^[[:space:]]*unix_socket_directories[[:space:]]*=/d' "$data/postgresql.conf" || return 1
   { printf '%s\n' "port = $PG_PORT"; printf '%s\n' "unix_socket_directories = '$sockdir'"; } >> "$data/postgresql.conf" || return 1
-  pg_ctl -D "$data" -o "-F" -w start || return 2
+  with_closed_fds pg_ctl -D "$data" -o "-F" -w start || return 2
 
   user="$(id -un)" || return 1
   if [ "$PG_REUSE" -eq 0 ]; then