feat: add pg_stat_statements and improve schema safety

- Add pg_stat_statements extension to prepare-db (with IF NOT EXISTS)
- Remove IF NOT EXISTS from postgres_ai schema creation
  (fails if exists, prompting user to run unprepare-db first)
- Add tests to verify pg_stat_statements is not dropped by unprepare-db
- Add tests to verify schema creation fails if exists

Author: claude

cli/sql/02.permissions.sql

@@ -3,12 +3,18 @@
 -- Allow connect
 grant connect on database {{DB_IDENT}} to {{ROLE_IDENT}};
 
+-- Enable pg_stat_statements for query performance monitoring
+-- Note: Uses IF NOT EXISTS because extension may already be installed
+create extension if not exists pg_stat_statements;
+
 -- Standard monitoring privileges
 grant pg_monitor to {{ROLE_IDENT}};
 grant select on pg_catalog.pg_index to {{ROLE_IDENT}};
 
 -- Create postgres_ai schema for our objects
-create schema if not exists postgres_ai;
+-- Note: We intentionally do NOT use "IF NOT EXISTS" here.
+-- If the schema already exists, this will fail - user should run unprepare-db first.
+create schema postgres_ai;
 grant usage on schema postgres_ai to {{ROLE_IDENT}};
 
 -- For bloat analysis: expose pg_statistic via a view

cli/test/init.test.ts

@@ -537,6 +537,48 @@ describe("init module", () => {
     expect(result.errors.length).toBe(1);
     expect(result.errors[0]).toMatch(/02\.revoke_permissions.*division by zero/);
   });
+
+  test("buildInitPlan includes pg_stat_statements extension", async () => {
+    const plan = await init.buildInitPlan({
+      database: "mydb",
+      monitoringUser: DEFAULT_MONITORING_USER,
+      monitoringPassword: "pw",
+      includeOptionalPermissions: false,
+    });
+
+    const permStep = plan.steps.find((s) => s.name === "02.permissions");
+    expect(permStep).toBeTruthy();
+    // Should create pg_stat_statements with IF NOT EXISTS
+    expect(permStep!.sql).toMatch(/create extension if not exists pg_stat_statements/i);
+  });
+
+  test("buildInitPlan does NOT use IF NOT EXISTS for postgres_ai schema", async () => {
+    const plan = await init.buildInitPlan({
+      database: "mydb",
+      monitoringUser: DEFAULT_MONITORING_USER,
+      monitoringPassword: "pw",
+      includeOptionalPermissions: false,
+    });
+
+    const permStep = plan.steps.find((s) => s.name === "02.permissions");
+    expect(permStep).toBeTruthy();
+    // Should create schema WITHOUT IF NOT EXISTS (will fail if exists)
+    expect(permStep!.sql).toMatch(/create schema postgres_ai;/i);
+    expect(permStep!.sql).not.toMatch(/create schema if not exists postgres_ai/i);
+  });
+
+  test("buildUninitPlan does NOT drop pg_stat_statements extension", async () => {
+    const plan = await init.buildUninitPlan({
+      database: "mydb",
+      monitoringUser: DEFAULT_MONITORING_USER,
+      dropRole: true,
+    });
+
+    // Check all steps - none should drop pg_stat_statements
+    for (const step of plan.steps) {
+      expect(step.sql.toLowerCase()).not.toMatch(/drop extension.*pg_stat_statements/);
+    }
+  });
 });
 
 describe("CLI commands", () => {