what's the escape sequence for hyphen (-) in PostgreSQL

Double quotes should do it. But you'll have to always use the quoted-identifier everywhere you reference the database.

ALTER DATABASE one RENAME TO "one-two";