Add read/write splitting to the pg module

pg.Cluster wraps a primary pool and an optional read-replica pool.
Routing is explicit — Read(), Write(), Primary() — with no SQL
inspection: statement text misroutes CTE writes and SELECT ... FOR
UPDATE in both directions.

An unhealthy replica falls back to the primary behind a ping-based
circuit that retries on a doubling backoff window, and migrations always
run through Write().

pg.ClusterDSNsFromEnv resolves both endpoints from the environment,
naming the read-only host explicitly rather than deriving it from the
primary's.

pg/pg.go

@@ -1,6 +1,7 @@
 // Package pg holds the estate's shared Postgres plumbing: environment-driven
-// DSN construction, pgxpool construction, and the migration runner every
-// service uses to bring its own schema up to date at startup.
+// DSN construction, pgxpool construction, read/write splitting across a primary
+// and a read replica, and the migration runner every service uses to bring its
+// own schema up to date at startup.
 package pg
 
 import (