SND on Postgres: fix recursive CTEs and LabKey-SQL queries

[labkey-martyp]

Rationale

Follow-up fixes to the SND PostgreSQL migration in 26.3. The recursive CTEs in snd.fGetSuperPkg and snd.fGetProjectItems produced colliding TreePath segments under PostgreSQL because window functions are forbidden in the recursive term of WITH RECURSIVE, so SortOrder was being formatted directly into a 3-character right-justified string. Two LabKey-SQL queries (DeletedLookupSets, DeletedLookups) still used MSSQL-specific functions (charindex, len) that don't resolve in LabKey SQL after the move to PG. SNDManager.updateProjectField had a generic field-name-as-string parameter that was concatenated into a SQL string but only ever called with "EndDate" — tightening it removes a latent SQL-injection shape.

Changes

• PostgreSQL recursive CTEs (snd/resources/schemas/dbscripts/postgresql/snd-0.000-25.000.sql) — Rewrote snd.fGetSuperPkg and snd.fGetProjectItems to pre-compute per-parent ordinals in a non-recursive CTE (ROW_NUMBER() OVER (PARTITION BY ParentSuperPkgId ORDER BY SortOrder NULLS FIRST, SuperPkgId)), then join to it from both the anchor and recursive members. TreePath segments now use LPAD(Ordinal::TEXT, 6, '0') instead of RIGHT(REPEAT(' ', 3) || COALESCE(SortOrder, 0)::VARCHAR, 3), eliminating the 3-character truncation and the collisions between siblings that share a SortOrder. NULLS FIRST matches the MSSQL twin's default NULL ordering and the prior PG COALESCE(SortOrder, 0) behavior. Inline comments call out the divergence from the sqlserver/ twin and recommend aligning MSSQL later.
• LabKey-SQL portability (snd/resources/queries/snd/DeletedLookupSets.sql, DeletedLookups.sql) — Replaced MSSQL-only charindex(...) / len(...) with the LabKey-SQL portable locate(...) / length(...) so these queries resolve under PostgreSQL.
• SNDManager.updateProjectField → updateProjectEndDate — The only call site ever passed "EndDate" for the field parameter. The method now hardcodes SET EndDate = ?, dropping the field-name string concatenation. No behavior change at the call site; removes a SQL-injection-shaped parameter and a stale doc comment.

Notes for reviewers

• No schema version bump is needed: SND has not yet been rolled out on PostgreSQL anywhere, so the consolidated snd-0.000-25.000.sql script can be edited in place — there are no deployed installs that would need an incremental upgrade script.