rename(547): the server is grimoire — package, image, DB defaults, backups

Step 2 of the Scribe -> Grimoire rename.

- src/scribe -> src/grimoire, and every import, patch target, module path,
  hypercorn entry point and `python -m grimoire.restore` with it; pyproject,
  uv.lock and the frontend package are named grimoire.
- Image git.fabledsword.com/bvandeusen/fabledgrimoire; CI's Postgres service
  runs as grimoire / grimoire_test.
- Compose files default the DB user, database and (prod) volume to grimoire,
  each overridable from .env, so an install created as Scribe keeps its data
  by setting POSTGRES_USER, POSTGRES_DB and PGDATA_VOLUME.
- Backups are written as grimoire-<ts>.tar with format grimoire-backup-tar.
  Archives named scribe-* with the scribe-backup-tar manifest still restore
  and are still counted at the destination (folder and S3), with tests.
- Exports, the MCP auth realm, the ASGI scope key and the persistent logger
  carry the new name.

Kept on purpose: the secret-sealing key label stays "scribe.secrets.v1",
because every stored secret was derived under it.

Plugin identity (plugin name, hooks, env vars, .scribe marker, skills) is
step 3.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_startup_survives_a_slow_database.py

@@ -29,7 +29,7 @@ async def test_a_hanging_settings_read_does_not_hang_startup():
     """The load-bearing one. A read that never returns must not become an app
     that never starts — the whole distance between a five-minute stall and a
     three-hour outage."""
-    from scribe.services import db_maintenance_scheduler as sched
+    from grimoire.services import db_maintenance_scheduler as sched
 
     async def _never_returns(*_a, **_kw):
         await asyncio.Event().wait()          # exactly what the disk stall did
@@ -48,7 +48,7 @@ async def test_the_timeout_is_logged_loudly_enough_to_find():
     """Without a WARNING the app logs a few scheduler lines and stops, and the
     cause is only recoverable from Postgres's own log. This is the breadcrumb
     that names it."""
-    from scribe.services import db_maintenance_scheduler as sched
+    from grimoire.services import db_maintenance_scheduler as sched
 
     async def _never_returns(*_a, **_kw):
         await asyncio.Event().wait()
@@ -71,7 +71,7 @@ async def test_the_timeout_is_logged_loudly_enough_to_find():
 @pytest.mark.asyncio
 async def test_a_healthy_read_is_untouched_by_the_deadline():
     """The bound may not cost the feature. A configured hour still wins."""
-    from scribe.services import db_maintenance_scheduler as sched
+    from grimoire.services import db_maintenance_scheduler as sched
 
     with patch.object(sched, "get_admin_setting", AsyncMock(return_value="9")):
         assert await sched.get_maintenance_hour() == 9
@@ -81,7 +81,7 @@ async def test_a_healthy_read_is_untouched_by_the_deadline():
 async def test_a_failing_read_still_yields_a_usable_hour():
     """A raised exception is the other way a sick database answers, and it must
     land in the same place as the timeout rather than escaping into the hook."""
-    from scribe.services import db_maintenance_scheduler as sched
+    from grimoire.services import db_maintenance_scheduler as sched
 
     with patch.object(sched, "get_admin_setting",
                       AsyncMock(side_effect=OSError("connection reset"))):
@@ -92,7 +92,7 @@ def test_the_startup_deadline_leaves_room_inside_the_lifespan_budget():
     """The number has to be smaller than the budget it lives in, or bounding
     the read buys nothing. Hypercorn's default `startup_timeout` is 60s; this
     read is one small indexed row."""
-    from scribe.services.db_maintenance_scheduler import _STARTUP_READ_TIMEOUT
+    from grimoire.services.db_maintenance_scheduler import _STARTUP_READ_TIMEOUT
 
     assert 0 < _STARTUP_READ_TIMEOUT <= 10
 
@@ -151,7 +151,7 @@ def test_startup_releases_the_flag_in_a_finally():
     and `create_task` must come before the block that can raise."""
     import inspect
 
-    from scribe import app as app_module
+    from grimoire import app as app_module
 
     src = inspect.getsource(app_module.create_app)
     assert "_startup_finished.set()" in src
@@ -176,7 +176,7 @@ def test_the_engine_bounds_how_long_a_connect_may_take():
     there is nothing on the engine to interrogate and a guard that tried would
     pass whatever the value became.
     """
-    from scribe.models import _CONNECT_ARGS
+    from grimoire.models import _CONNECT_ARGS
 
     timeout = _CONNECT_ARGS.get("timeout")
     assert timeout is not None, "a connect with no deadline"
@@ -188,7 +188,7 @@ def test_no_blanket_command_timeout_was_added_with_it():
     follow-up. `command_timeout` applies to EVERY statement, and this app runs
     long ones on purpose — the embedding backfills, VACUUM ANALYZE. It would
     trade a hung startup for killed maintenance."""
-    from scribe.models import _CONNECT_ARGS
+    from grimoire.models import _CONNECT_ARGS
 
     assert "command_timeout" not in _CONNECT_ARGS
 
@@ -199,7 +199,7 @@ def test_the_engine_actually_uses_those_args():
     inline literal, and every assertion above would keep passing."""
     import inspect
 
-    from scribe import models
+    from grimoire import models
 
     src = inspect.getsource(models)
     assert "connect_args=_CONNECT_ARGS" in src
@@ -207,7 +207,7 @@ def test_the_engine_actually_uses_those_args():
 
 def test_the_startup_guards_can_fail():
     """Each assertion above has to be able to bite."""
-    from scribe.services.db_maintenance_scheduler import _STARTUP_READ_TIMEOUT
+    from grimoire.services.db_maintenance_scheduler import _STARTUP_READ_TIMEOUT
 
     # An unbounded read is the thing being prevented.
     assert _STARTUP_READ_TIMEOUT != float("inf")