feat: add extended post-auth logging and run config on every start

[jozefrebjak]

Summary

• Add CUSTOM_MYSQL_QUERIES_POST_AUTH_EXTENDED env var to log Calling-Station-Id (client IP) and Called-Station-Id (VPN gateway IP) in radpostauth table
• Move post-auth schema migrations (ALTER TABLE) outside init lock — runs on every container start, safe to re-run
• Move post-auth query replacement outside init lock — enables toggling extended/basic logging without deleting init lock

Usage

CUSTOM_MYSQL_QUERIES_POST_AUTH: "true"
CUSTOM_MYSQL_QUERIES_POST_AUTH_EXTENDED: "true"

Test plan

• Start container with CUSTOM_MYSQL_QUERIES_POST_AUTH=true and CUSTOM_MYSQL_QUERIES_POST_AUTH_EXTENDED=true
• Verify callingstationid and calledstationid columns are added to radpostauth
• Verify post-auth query includes both new fields
• Restart container — verify schema check and query replacement run again without issues
• Disable EXTENDED and restart — verify query reverts to basic version
• Verify existing data is preserved after schema changes

Closes #4