feat(vision-manager): memory-pressure yield gate (+ retain analysis gate) (#8)

vision-manager/readonly-role.sql

@@ -26,7 +26,11 @@ SELECT 'CREATE ROLE vision_manager LOGIN'
 -- (Re)set the password every run so rotating it is just a re-apply.
 ALTER ROLE vision_manager LOGIN PASSWORD :'pw';
 
--- CONNECT to the current database, and read-only on the one table we poll.
+-- CONNECT to the current database, and read-only on the two tables we poll:
+-- crawler_jobs (backlog depth + crawl-in-flight) and app_settings (the runtime
+-- analysis-enabled flag — without this the manager can't tell that analysis was
+-- turned off and would keep vision pinned on stale queued jobs).
 GRANT CONNECT ON DATABASE :"DBNAME" TO vision_manager;
 GRANT USAGE ON SCHEMA public TO vision_manager;
 GRANT SELECT ON crawler_jobs TO vision_manager;
+GRANT SELECT ON app_settings TO vision_manager;