feat(rds): add private PostgreSQL module

[ciiiii]

Motivation

SQL Workspace needs a private PostgreSQL meta store per poolmember. The resources were previously defined inline in the provisioning layer; moving them into a module lets the AWS v1 and v2 paths share one definition.

Modifications

• Add modules/rds: a private PostgreSQL instance in the VPC's private subnets, with its DB subnet group, security group and generated master password.
• Ingress is limited to the PostgreSQL port from vpc_cidr; the instance is never publicly accessible and storage is encrypted.
• Expose a sensitive connection output (host, port, username, password, database) so the caller can write the credential to its own secret store. The module has no Kubernetes provider.
• Treat the instance as disposable: backup_retention_period defaults to 0, skip_final_snapshot is on and deletion protection is off, so teardown cannot be blocked.

Notes:

• vpc_cidr must be the cidr actually in use by vpc_id. When the VPC is supplied rather than created, read it with a data "aws_vpc" lookup — a requested cidr produces an ingress rule that does not match and the instance is unreachable.
• The module has no enabled flag; callers gate it with count on the module block.

Verifying this change

• Make sure that the change passes the CI checks.

terraform validate and terraform fmt -check pass. Exercised end to end against a test environment: instance create, update and delete, and a workload pod connecting over TLS 1.3.

Documentation

• doc

  modules/rds/README.md generated with terraform-docs.