postgres: broker personal PostgresAccess through nais API

[jhrv]

Goal

Expose an authorized, API-brokered request for time-limited personal Postgres access.

Parent contract: nais/pgrator#145. The API owns authentication, authorization,
audit correlation and creation/replacement/deletion of PostgresAccess; pgrator
owns its reconciliation. The caller must never create or select a Tunnel,
DatabaseRole, target address, port, Kubernetes Secret, or Kubernetes credential.

Acceptance criteria

• Define the API request/result contract using logical Postgres, selected ready
  PostgresInstance, access level, and the CLI WireGuard public key.
• Authenticate the user and authorize team, environment, logical Postgres,
  physical instance and requested access level before creating PostgresAccess.
• Create, observe, replace and delete PostgresAccess through the API's
  Kubernetes broker identity; callers receive no Kubernetes credentials.
• Return connection material only after PostgresAccess is Ready, without
  exposing implementation target details or arbitrary Secrets.
• Correlate audit events across API request, PostgresAccess, durable database
  identity and Tunnel lifecycle.
• Cover unauthorized and caller-supplied-target negative cases.

Dependencies

PostgresAccess implementation in nais/pgrator#144 must merge before an end-to-end
flow can be enabled. Tunnel transport qualification remains a production gate,
not a blocker for this API contract work.

[jhrv]

Work restarted on a clean pgaccess branch from origin/main. The first delivery is the API-brokered, no-port-forward creation contract; replacement and Ready/credential response semantics are being traced against existing API patterns before implementation.