feat: deliver the database credential an edge derives, as itself or to the environment

[ExtraToast]

Summary

The slice of #378 that #448 needs. An edge to a database now derives its Process's login, and the project file can hand it to the environment:

dependsOn:
  - application: platform-postgres
    surface: postgres
    credentials: {delivery: env, rotation: {tolerates: restart}}

PGUSER=${dependency:platform-postgres.username}
PGPASSWORD=${dependency:platform-postgres.password}

• What every edge to a database derives. Every edge to a Process whose engine owns databases derives the consuming Process's credential, as chapter 10 already said and nothing rendered. Its role is the project's data role, or its owner role where the Application migrates itself (migration: self). It is read from database/creds/<role>, which the catalog's Vault roles issue (feat: apply the database catalog in the cluster by its engine's method #459). Delivered self (the default), the Process reads it from the Secret Store and its token is mounted.
• credentials.delivery. The edge's credentials gains delivery: self | env. Delivered env, the render emits a VaultDynamicSecret (database mount, creds/<role>, untracked by Flagger, restart targets as for a static secret). The two new coordinates, username and password, read it as secretKeyRefs.
• Refusals.
  • A credential coordinate on an edge that does not deliver env, or one used as part of a value, is E_UNRESOLVED_PLACEHOLDER.
  • An env credential that tolerates a reload is E_ENV_CANNOT_RELOAD.
  • delivery: file on an edge is a schema refusal.
• Rules that grew.
  • A Process with such an edge now orders its unit after estate-vso-secrets.
  • A Process with such an edge also needs a secretStore (E_NO_SECRET_STORE).
• Both implementations, the oracles and the spec.
  • The worked knowledge platform's hindsight-api takes its login as env.
  • auth's and hindsight-worker's processes now hold the derived self credential.
  • Chapters 10 and 30, ADR 0026, CONTEXT.md and REQ-062 say so.

Left on #378: delivery: file for an edge credential, the 10-minute static refresh, dropping injector annotations, chapter 17's no-token rule, and the ADR 0030 rewrite.

Verification

• npm run verify passes. New tests cover:
  • the dynamic secret and its variables;
  • the derived role, data under a changelog and owner under self;
  • each refusal;
  • which edges reach a database.
• Stryker on the new credential code leaves no survivor.
• ./mvnw clean verify under emf/ passes: both implementations render the knowledge-platform and auth trees byte for byte.

Part of #378. Unblocks #448.

[github-actions]

Shape

bucket	files	additions	deletions
production code	19	+458	-78
tests	5	+244	-14
specification	5	+39	-7
decision records	1	+4	-2
documentation	3	+10	-2
examples	20	+83	-27

Coverage

Baseline: main @ 4ec2ea2.

metric	this branch	main	diff
statements	99.57%	99.57%	0.00
branches	98.43%	98.40%	+0.03
functions	100.00%	100.00%	0.00
lines	99.53%	99.52%	+0.01

Lines this pull request changed: 49/49 covered (100.00%).