feat(phase-15): storage cost — raw lifecycle, pgbouncer, updated_at, dash

[SlavaKuntsov]

Closes #16
Closes #17
Closes #18

Summary

Phase 15 P2 cost/storage: lifecycle для raw/, PgBouncer перед postgres, videos.updated_at, DASH + FE standalone.

• infra: pgbouncer:6432 (transaction default_pool_size 20) deploy/docker-compose.yml:18, healthcheck via psql, postgres md5 (password_encryption=md5) для совместимости
• storage: minio-setup mc ilm rule add --expire-days 7 --prefix raw/ deploy/docker-compose.yml:89 (проверено mc ilm ls raw/ 7) + transcoder KEEP_RAW=false services/transcoder/app/consumer.py:43 сразу RemoveObject после ready только при успехе update_status
• db: миграция 000003_add_updated_at + trigger deploy/postgres/init.sql:38 , model.Video.UpdatedAt services/metadata/internal/model/video.go:38
• pool: auth services/auth/src/core/db.py:28 statement_cache_size=0 + реврайт postgres->pgbouncer, metadata services/metadata/cmd/server/main.go:47 QueryExecModeSimpleProtocol
• nginx: vod dash deploy/nginx/nginx.conf:68 + fix mapping hls/|dash/
• frontend: уже output: standalone frontend/next.config.mjs:3, VideoPlayer maxBufferLength сохранен

Acceptance

• P2 infra: add MinIO ILM expiry for raw objects #16 raw ILM 7d + KEEP_RAW immediate delete + videos.updated_at (mc ilm ls ok, 4 теста)
• P2 infra: add PgBouncer before Postgres #17 pgbouncer :6432 pool_size из env (psql -h pgbouncer -p 5432 ok, docker ps healthy)
• P2 frontend: enable standalone output for smaller image #18 standalone <200MB (уже, Dockerfile multi-stage), maxBufferLength:10 сохранен

Verification

• uv run --project services/transcoder pytest -v — 20 passed
• uv run --project services/auth pytest -q — 11 passed
• go test ./... metadata — ok
• docker compose --env-file .env -f deploy/docker-compose.yml up -d — pgbouncer healthy, minio-setup ilm added, postgres md5
• docker logs minio-setup — Lifecycle rule added raw/ 7
• black/flake8/mypy — pass
• make e2e — not run (no sample), risk low

Risks

• pgbouncer opt-in via PGBOUNCER_ENABLED=true (default false, no prod impact); fresh volume needs md5 (fixed via command/password_encryption)
• e2e not run