refactor leader election around DB-issued "terms"

[bgentry]

The old elector treated leadership as a lease held by one client ID and renewed over time. That kept the happy path simple, but it left too much implicit. One leadership term was not clearly separated from the next, so reelection and resignation were not scoped to a specific term. That made same-client reacquisition and stale cleanup harder to reason about than they needed to be.

This rewrite makes the database issue explicit leadership terms using the columns we already have. leader_id still identifies the client, while (leader_id, elected_at) identifies one specific term. Elect, reelect, and resign now all operate on that exact term and return the leader row directly from the database.

The elector still keeps a bounded local trust window for its last successful confirmation, but that window is now anchored to the attempt that produced it rather than to when a response happened to arrive. That keeps slow successful reelections from stretching leadership past the real lease budget, while still avoiding direct app-vs-database clock comparisons in the state machine.

This branch also adds an explicit Time.Now API at the base-service layer. The old shared API only exposed NowUTC, even for code doing local deadline and duration math. For the elector that was the wrong abstraction, because these comparisons need to preserve Go's monotonic time.Time reading rather than normalize through UTC. Making that API explicit lets the elector use the right local clock for trust-window calculations while keeping NowUTCOrNil for the existing test path that passes stubbed wall-clock timestamps through to database code.

The tests were rewritten around the final model instead of the intermediate mechanics. The shared driver suite now covers term-scoped elect, reelect, and resign behavior across PostgreSQL and both SQLite backends, including same-client term replacement and stale-term rejection. The elector tests focus on observable behavior such as leadership handoff, resign requests, ordered subscriber notifications, and stepping down cleanly when the trust window expires.

This also rolls up the branch's earlier flake investigation and keeps the original CI reference for the shared-schema failures that led to the redesign:
https://github.com/riverqueue/river/actions/runs/24406465152

[bgentry]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Nice work!

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[bgentry]

@brandur took a whole bunch of turns and iteration to get this to where I want it but I think it's pretty solid now! Pared back a lot of the added complexity from earlier just by going all in on "DB is source of truth including for time".