fix(scripts): brain-embeddings-init.sql psql-level conditionals

CREATE DATABASE doesn't work inside a DO $$ ... $$ block (transactional
restriction). And psql `:'var'` substitutions resolve client-side, so
they can't reach inside a DO block either.

Replace both DO blocks with psql-native idioms:
- `\gexec` for the conditional CREATE DATABASE
- `\if` + `\gset` for the create-or-rotate-password branch on the
  brain_app role

Verified end-to-end on koala postgres18: brain DB created, vector
0.8.1 extension installed, brain_app role login works.

scripts/brain-embeddings-init.sql

@@ -21,21 +21,20 @@
 
 \set ON_ERROR_STOP on
 
-DO $$
+-- CREATE DATABASE cannot run inside a DO block (transactional limitation).
-BEGIN
+-- Use \gexec to emit the statement conditionally instead.
-    IF NOT EXISTS (SELECT 1 FROM pg_database WHERE datname = 'brain') THEN
+SELECT 'CREATE DATABASE brain'
-        CREATE DATABASE brain;
+WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = 'brain')
-    END IF;
+\gexec
-END
-$$;
 
-DO $$
+-- DO blocks can't see psql `:'password'` substitutions (those resolve
-BEGIN
+-- client-side). Use \if to branch at psql level instead.
-    IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'brain_app') THEN
+SELECT EXISTS (SELECT FROM pg_roles WHERE rolname = 'brain_app') AS role_exists \gset
-        EXECUTE format('CREATE ROLE brain_app LOGIN PASSWORD %L', :'password');
+\if :role_exists
-    END IF;
+    ALTER ROLE brain_app WITH PASSWORD :'password';
-END
+\else
-$$;
+    CREATE ROLE brain_app LOGIN PASSWORD :'password';
+\endif
 
 GRANT ALL PRIVILEGES ON DATABASE brain TO brain_app;