feat: clone major upgrade

Part of #755 (feature list: #627).

In-place major upgrade of an existing clone to test new PostgreSQL versions: POST /clone/{id}/upgrade, dblab clone upgrade CLONE_ID --target-version N, CE UI action. pg_upgrade --link runs in a one-off container from a per-target-major pg-upgrade image (derived from extended-postgres:<new> so extension .sos match) inside the clone's ZFS dataset; the clone restarts on the target-version image via a per-clone models.Clone.DockerImage override. Reset re-provisions from the snapshot on the engine default image and serves as rollback.

Starts with the implementation plan (docs/plans/20260813-clone-major-upgrade.md); implementation lands here task by task:

1. models + API request types
2. pg-upgrade image + upgrade script
3. provision config + per-clone image override
4. provisioner upgrade orchestration
5. cloning orchestration + safety guards (idle sweeper, destroy/reset, restart-during-upgrade)
6. HTTP endpoint, client, swagger
7. CLI command
8. CE UI
9. config examples + docs

Out of scope for iteration 1: clones created from a committed upgraded snapshot (needs snapshot-level image resolution in StartSession; follow-up in the plan).

Closes #756 (closed)