feat(esa-1866): add CustomRole CRD and controller

[tmablunar]

We want a capability to define custom db roles that are added to all instances. This could (and should) replace something like the hardcoded management_role.

Summary

• Adds CustomRole CRD (postgresql.lunar.tech/v1alpha1) for declaratively defining a PostgreSQL role with specific permissions
• Controller creates the role (NOLOGIN), grants server-level roles (e.g. pg_monitor), and applies schema/table privilege grants across all user databases
• Reconciles automatically when a new PostgreSQLDatabase CR appears (via Watches)
• Empty or "*" for schema/table expands to all user schemas/tables via pg_namespace/pg_database queries

Stacked on #350.

Test plan

• Integration tests: POSTGRESQL_CONTROLLER_INTEGRATION_HOST=<host> go test ./pkg/postgres/... -run TestEnsureCustomRole -v
• Integration tests: POSTGRESQL_CONTROLLER_INTEGRATION_HOST=<host> go test ./pkg/postgres/... -run TestApplyDatabaseGrants -v
• Integration tests: POSTGRESQL_CONTROLLER_INTEGRATION_HOST=<host> go test ./pkg/postgres/... -run TestUserDatabases -v
• Apply a CustomRole CR and verify the role + grants exist on the target Postgres instance

🤖 Generated with Claude Code

---

Note

High Risk
Introduces new reconciliation logic that creates/drops PostgreSQL roles and grants/revokes privileges across all user databases, which is security-sensitive and could impact access if misconfigured or buggy.

Overview
Adds a new namespaced CustomRole CRD for declaring Postgres roles with server-level memberships (grantRoles) and per-database table privileges (grants), plus status phases (Running/Failed/Invalid) and finalizer-based cleanup on deletion.

Implements a CustomRoleReconciler that reconciles the role across all configured hosts, watches PostgreSQLDatabase transitions to Running to re-apply grants for newly provisioned DBs, and updates CR status with retry/drop behavior for temporary vs invalid errors.

Adds Postgres helpers to create NOLOGIN roles, diff-and-sync role memberships and table/schema grants (including wildcard schema/table expansion and skipping missing objects), revoke all grants on deletion, and includes integration tests covering grant combinations and revocation behavior; updates RBAC, CRD manifests, sample YAML, and README documentation accordingly.

^{Reviewed by Cursor Bugbot for commit 9aca465. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9aca465. Configure here.}