fix: authenticate PostgreSQL IAM connections on demand

[deinspanjer]

PostgreSQL IAM pool rotation disconnects healthy sessions every 14 minutes. If credential renewal fails, subsequent requests can report that a configured source is missing even after the user signs in again.

Resolve IAM passwords through pg's async password callback when a physical connection opens. Keep the pool/source available after failed authentication or an idle-session disconnect, so a later request can recover without restarting DBHub.

• Share in-flight token requests per source configuration, including after a socket timeout, without adding background authentication retries or SQL replay.
• Retain strict explicit-profile selection and the SDK default provider chain otherwise; reread replaced shared credentials on later attempts.
• Preserve TLS settings and sign the original RDS endpoint through SSH; close a tunnel if initial authentication fails.
• Correct the PostgreSQL SSL type annotation to use pg.PoolConfig["ssl"].
• Document SSO/credential-process login, per-source idle timeouts, and browser/connection-timeout behavior. MySQL/MariaDB retain their existing refresh behavior.

Validation:

• 1,003 unit tests pass, including real pg loopback authentication/idle-disconnect recovery and real AWS SDK tests with isolated synthetic credentials and a credential process.
• Backend build and all six connector import smoke tests pass.
• Live candidate DBHub MCP read-only probe against an existing PostgreSQL IAM source succeeds, including opening a replacement physical session after pool idle eviction.
• tsc --noEmit reports 132 diagnostics versus 133 on clean upstream: the existing PostgreSQL SSL type error is fixed, with no new diagnostics. The full Docker integration suite was not run locally.

Real multi-hour role/session expiry and interactive browser authorization still need a longer local trial. SSO, web identity, role assumption, and container/instance providers retain SDK routing; they were researched against primary sources but not all exercised end to end.

[deinspanjer]

I'll spend next week testing this build live in my normal workflow, including credential renewal and recovery after authentication failures. I'll keep this PR in draft and mark it ready for review after that testing is complete.