migrate to the new tiered structure

example/.safeclaude/hooks/30-pg-proxy.sh

@@ -0,0 +1,15 @@
+#!/bin/bash
+# Makes the host machine's Postgres reachable at the usual 127.0.0.1:5432 inside
+# the container, so your database settings work the same in or out of Docker.
+set -euo pipefail
+
+# If something's already answering on 5432 (like a proxy from a previous launch),
+# leave it be. We test the port with a built-in bash trick so we don't have to
+# install extra tools just to check.
+if (exec 3<>/dev/tcp/127.0.0.1/5432) 2>/dev/null; then
+  exec 3>&-   # port answered — already running
+else
+  echo "[pg] proxying 127.0.0.1:5432 -> host.docker.internal:5432"
+  socat TCP-LISTEN:5432,bind=127.0.0.1,fork,reuseaddr \
+        TCP:host.docker.internal:5432 &
+fi