Summary

• --init wizard: new database backend selection step (sqlite/postgres); postgres branch prints vault instruction (zeph vault set ZEPH_DATABASE_URL), writes empty placeholder to config, skips sqlite_path
• --migrate-config: new migrate_database_url() step injects commented-out database_url under [memory]; handles missing section, idempotent
• zeph db migrate: new CLI subcommand that validates backend URL, connects, runs pending migrations, prints count; credentials redacted in all error paths
• CI build-postgres job: cargo check -p zeph-db --no-default-features --features postgres — keeps postgres feature flag buildable
• docker/docker-compose.yml: add ZEPH_DATABASE_URL: ${ZEPH_DATABASE_URL:-}

Deferred

• feat(postgres): fix SqliteStore call sites for postgres build #2374 (P2) — SqliteStore call sites don't compile under --features postgres (full workspace)
• test(db): add unit tests for db migrate URL validation branches #2377 (P2) — URL validation branches in db.rs have no unit tests
• test(init): add build_config test for postgres backend path #2378 (P2) — build_config postgres path in init.rs has no unit test
• audit: ZEPH_* env vars missing from docker/ compose files #2375 (P2) — full audit of ZEPH_* env vars vs docker/ files

Test plan

• cargo nextest run --workspace --lib --bins — 6608/6608 pass
• cargo check -p zeph-db --no-default-features --features postgres
• zeph --init — verify postgres branch prompts correctly, no URL stored in config
• zeph --migrate-config — verify idempotent on second run
• zeph db migrate — verify prints migration count on fresh DB