✨ feat(bdd): parallel-safe schema-per-package isolation (T12 stage 2/2)

Re-enables BDD_SCHEMA_ISOLATION=true with the foundation from PR #34
(NewPostgresRepositoryFromDSN). Achieves ~2.85x speedup on the BDD
test suite by running feature packages in parallel.

ARCHITECTURE

When BDD_SCHEMA_ISOLATION=true, each test package (process) gets its
own isolated PostgreSQL schema:
  1. testserver.Start() generates a deterministic schema name per FEATURE
  2. CREATE SCHEMA <name>
  3. Open a per-package gorm.DB with DSN search_path=<name>
  4. AutoMigrate runs in the isolated schema (creates users table)
  5. Build a per-package server.Server with this isolated repo via
     server.NewServerWithUserRepo
  6. Stop() drops the schema + closes the per-package pool

Packages then run in parallel (default Go test parallelism) without
contention because each has its own schema + connection pool.

CHANGES

- pkg/server/server.go : NEW factory NewServerWithUserRepo(cfg, ctx,
  userRepo, userService) that injects a per-test repo. Existing NewServer
  becomes a thin wrapper.
- pkg/bdd/testserver/server.go : Start() chooses isolated mode based on
  BDD_SCHEMA_ISOLATION env var. Stop() drops schema + closes pool.
- pkg/user/postgres_repository.go : Exec(sql) helper for the schema
  lifecycle (CREATE/DROP) used by testserver.
- scripts/run-bdd-tests.sh : -p 1 only when BDD_SCHEMA_ISOLATION!=true.
  When true, default Go parallelism (~ NumCPU packages concurrent).
- .gitea/workflows/ci-cd.yaml : exports BDD_SCHEMA_ISOLATION=true.
- adr/0025-bdd-scenario-isolation-strategies.md : Status to "Implemented".

VALIDATION

5x AuthBDD with isolation: 5/5 PASS, public.users count=0 after runs.

Local benchmark on the full features/... suite:
- Sequential -p 1 (no isolation):     12.87s
- Parallel + isolation (this PR):      4.51s
- Speedup: 2.85x

🤖 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

pkg/server/server.go

@@ -71,7 +71,21 @@ type Server struct {
 }
 
 func NewServer(cfg *config.Config, readyCtx context.Context) *Server {
-	// Create validator instance
+	// Initialize default user repository and services (Postgres from cfg)
+	userRepo, userService, err := initializeUserServices(cfg)
+	if err != nil {
+		log.Warn().Err(err).Msg("Failed to initialize user services, user functionality will be disabled")
+	}
+	return NewServerWithUserRepo(cfg, readyCtx, userRepo, userService)
+}
+
+// NewServerWithUserRepo builds a Server with caller-provided userRepo + userService.
+// Used by BDD test infra to inject a per-scenario repository (e.g., one connected
+// to an isolated PostgreSQL schema). Pass nil for both to disable user functionality.
+//
+// The validator + cache services are still built from cfg internally; they don't
+// need per-scenario isolation today.
+func NewServerWithUserRepo(cfg *config.Config, readyCtx context.Context, userRepo user.UserRepository, userService user.UserService) *Server {
 	validator, err := validation.GetValidatorFromConfig(cfg)
 	if err != nil {
 		log.Error().Err(err).Msg("Failed to create validator, continuing without validation")
@@ -79,13 +93,6 @@ func NewServer(cfg *config.Config, readyCtx context.Context) *Server {
 		log.Trace().Msg("Validator created successfully")
 	}
 
-	// Initialize user repository and services
-	userRepo, userService, err := initializeUserServices(cfg)
-	if err != nil {
-		log.Warn().Err(err).Msg("Failed to initialize user services, user functionality will be disabled")
-	}
-
-	// Initialize cache service
 	var cacheService cache.Service
 	if cfg.GetCacheEnabled() {
 		cacheService = cache.NewInMemoryService(