chore(fixtures): bump the @constructive-db fixture modules to the same-scope FK release

[pyramation]

Summary

Moves the root pgpm.json fixture pins onto the just-published output of the constructive-db same-scope foreign key fix (constructive-io/constructive-platform#21):

-  "@constructive-db/apps": "5.1.0",
-  "@constructive-db/catalog": "5.1.0",
-  "@constructive-db/routing": "6.1.0",
-  "@constructive-db/routing-platform": "5.1.0",
+  "@constructive-db/apps": "7.0.0",
+  "@constructive-db/catalog": "6.0.0",
+  "@constructive-db/routing": "8.0.0",
+  "@constructive-db/routing-platform": "7.0.0",

No test or fixture changes are needed for the FK change itself. The majors are breaking at the SQL level — routes.target_*, sites.bucket_id, app_components.component_* and friends now reference the same-scope source tables instead of the shared catalog_private.* projection — but __fixtures__/seed/scoped/test-data.sql already seeds each routing/apps source row alongside its catalog twin under the same id (and inserts the apps_public rows after routing_public.{apis,domains}), so every constraint is satisfied under either shape and resolve_route() reads the same compiled bindings.

One real break, in the bootstrap and not the tests: the new majors are the first to grant to authenticated_client (routing/…/rls_settings/grants, routing-platform/…/grants/usage) — npm pack of 6.1.0/5.1.0 contains zero references to it. That role is opt-in (admin-users bootstrap --client), so with a plain bootstrap --yes every seed.pgpm deploy died at role "authenticated_client" does not exist and took the whole integration-graphql and pg-graphql lanes with it. Added --client to the three CI bootstrap steps and to the local instructions that mirror them (Makefile, DEVELOPMENT.md, the two setup skills) — matching what constructive-platform's own AGENTS.md already requires of anyone deploying these modules.

Verified against the new modules with pgpm install -W --force: graphql/server-test 11/11 suites, 156 tests (including scoped-routing, fn-routes, express-context, upload) and graphile/graphile-function-bindings 2/2 suites, 22 tests.

Note that pgpm install -W @constructive-db/apps@latest does not move an already-installed module — it re-resolved the existing 5.1.0 pin and left pgpm.json untouched, so that one line was edited by hand and then verified by a forced reinstall (default_version = '7.0.0').

Link to Devin session: https://app.devin.ai/sessions/d1f8e59e2aeb44bcb6dbeb0edd1145c6
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring