fix(scripts): brain-embeddings-init.sql psql-level conditionals

CREATE DATABASE doesn't work inside a DO $$ ... $$ block (transactional
restriction). And psql `:'var'` substitutions resolve client-side, so
they can't reach inside a DO block either.

Replace both DO blocks with psql-native idioms:
- `\gexec` for the conditional CREATE DATABASE
- `\if` + `\gset` for the create-or-rotate-password branch on the
  brain_app role

Verified end-to-end on koala postgres18: brain DB created, vector
0.8.1 extension installed, brain_app role login works.

scripts/brain-embeddings-init.sql

@@ -21,21 +21,20 @@
 
 \set ON_ERROR_STOP on
 
-DO $$
-BEGIN
-    IF NOT EXISTS (SELECT 1 FROM pg_database WHERE datname = 'brain') THEN
-        CREATE DATABASE brain;
-    END IF;
-END
-$$;
+-- CREATE DATABASE cannot run inside a DO block (transactional limitation).
+-- Use \gexec to emit the statement conditionally instead.
+SELECT 'CREATE DATABASE brain'
+WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = 'brain')
+\gexec
 
-DO $$
-BEGIN
-    IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'brain_app') THEN
-        EXECUTE format('CREATE ROLE brain_app LOGIN PASSWORD %L', :'password');
-    END IF;
-END
-$$;
+-- DO blocks can't see psql `:'password'` substitutions (those resolve
+-- client-side). Use \if to branch at psql level instead.
+SELECT EXISTS (SELECT FROM pg_roles WHERE rolname = 'brain_app') AS role_exists \gset
+\if :role_exists
+    ALTER ROLE brain_app WITH PASSWORD :'password';
+\else
+    CREATE ROLE brain_app LOGIN PASSWORD :'password';
+\endif
 
 GRANT ALL PRIVILEGES ON DATABASE brain TO brain_app;