Add PostgreSQL reporting schema and ingest contract

infra/postgres/README.md

@@ -0,0 +1,30 @@
+# OfficeCom Sentinel PostgreSQL
+
+PostgreSQL is the private central store for endpoint reports. It is never
+contacted directly by an endpoint; only n8n uses a database account.
+
+## Provisioning
+
+1. Create a database named `ocsentinel` on the existing private PostgreSQL server.
+2. Apply `001_ocsentinel.sql` as a database administrator.
+3. Create a non-superuser n8n login and grant only the necessary permissions:
+
+```sql
+GRANT USAGE ON SCHEMA ocsentinel TO ocsentinel_n8n;
+GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA ocsentinel TO ocsentinel_n8n;
+GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA ocsentinel TO ocsentinel_n8n;
+GRANT SELECT ON ocsentinel.current_device_status, ocsentinel.organization_summary TO ocsentinel_n8n;
+ALTER DEFAULT PRIVILEGES IN SCHEMA ocsentinel
+  GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO ocsentinel_n8n;
+```
+
+Keep the database host, password, and TLS settings only in n8n credentials.
+They do not belong in Gitea, NinjaOne scripts, or endpoint configuration.
+
+## Maintenance
+
+Run monthly from n8n or an administrator session to remove expired replay tokens:
+
+```sql
+DELETE FROM ocsentinel.ingest_nonce WHERE expires_at < now();
+```