docs(config): document monitored-database user privileges

[dpage]

Summary

• Adds docs/getting-started/configuration/monitored-database-privileges.md,
  documenting the PostgreSQL privileges a monitoring role needs on a
  monitored instance. The docs previously covered only the datastore
  role, so a prospect asking what grants a monitoring user needs had no
  answer in the repository.
• Recommends a least-privilege role built on pg_monitor plus per-database
  CONNECT, and documents the optional pg_stat_statements and
  system_stats extensions, the Spock grants, and the gaps that remain
  without superuser access.
• Links the page from collector/README.md, the collector and connection
  configuration pages, and the probe reference, so it is discoverable from
  the getting-started section as the issue asked.

Notes on the grants

I derived the grants by auditing the probes against the collector source
and the PostgreSQL catalogue ACLs rather than taking the issue's suggested
SQL at face value, which turned up several corrections worth flagging for
review:

• pg_monitor is mandatory, not merely advisable: the pg_server_info
  probe calls current_setting('data_directory'), which raises a hard
  error without pg_read_all_settings and fails the whole probe.
• The Spock probes read five tables, not the two the issue listed;
  pg_node_role also reads spock.local_node, spock.node, and
  spock.subscription.
• pg_stat_wal_receiver is defined WHERE pid IS NOT NULL, so an
  unprivileged role sees zero rows rather than nulls, which breaks
  standby detection outright rather than blanking a column.
• Closing the pg_hba_file_rules and pg_ident_file_mappings gaps without
  granting superuser requires a grant on both the view and its
  underlying function; the function grant is easy to miss.
• pg_subscription.subconninfo is superuser-only and degrades publisher
  host and port detection silently.
• A missing CONNECT grant is skipped with a logged error rather than a
  fatal one, so it degrades coverage silently. This is the likeliest
  misconfiguration, so the page calls it out explicitly.

The page also covers something the issue did not anticipate: the MCP server
reuses the same stored credentials and several of its tools do read user
data, so the AI features need USAGE on schemas and SELECT on tables that
the collector itself never requires. Since the Workbench's read_write
setting is only an application-level gate, the role's own privileges are the
real backstop, which is framed as a deliberate security decision.

Test plan

• mkdocs build --strict passes with no warnings or errors, so the nav
  entry and every cross-link resolve.
• Verified the internal anchor target resolves in the built HTML.
• Confirmed all added lines wrap at 79 characters, bar unsplittable
  hyperlinks and the mkdocs nav path.
• Confirmed no test asserts on mkdocs.yml or docs paths; this diff
  touches no code, so lint and the Go/client suites are unaffected.
• All example values are synthetic (workbench_monitor, myapp, a
  placeholder password).

Closes #351

Summary by CodeRabbit

• Documentation
  • Added guidance on the PostgreSQL privileges required for monitored connections, including pg_monitor and per-database CONNECT access.
  • Added a dedicated Monitored Database Privileges guide with least-privilege recommendations, probe-specific requirements, optional extensions, and known limitations.
  • Updated collector setup, administration, probe reference, and security documentation with links and clarifications.
  • Added the new guide to the documentation navigation and unreleased changelog.

[coderabbitai]

Walkthrough

Changes

Monitored database privileges

Layer / File(s)	Summary
Role and connection requirements docs/getting-started/configuration/monitored-database-privileges.md	Documents the monitored PostgreSQL role, least-privilege grants, network access, and per-database CONNECT behavior.
Probe privilege coverage and gaps docs/getting-started/configuration/monitored-database-privileges.md	Describes extension and Spock grants, probe-specific privileges, pg_monitor requirements, non-superuser gaps, and AI/MCP access.
Documentation integration collector/README.md, docs/admin-guide/connections.md, docs/getting-started/configuration/collector.md, docs/developer-guide/collector/probe-reference.md, mkdocs.yml, docs/changelog.md	Adds links, prerequisites, navigation, probe context, and changelog coverage for the new privileges page.

Estimated code review effort: 2 (Simple) | ~15 minutes

Suggested reviewers: susan-pgedge

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The PR documents least-privilege grants, per-database CONNECT, optional extensions, non-superuser caveats, and adds discoverability links as requested in #351.
Out of Scope Changes check	✅ Passed	The changes are documentation-only and remain aligned with the linked issue and PR objectives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: documenting monitored-database user privileges in configuration docs.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/issue-351-monitor-privileges

---

_{Comment @coderabbitai help to get the list of available commands.}

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/getting-started/configuration/monitored-database-privileges.md`:
- Around line 253-254: Shorten each added Markdown hyperlink so the complete
construct remains on one line and every affected line is at most 79 characters.
Update the links at
docs/getting-started/configuration/monitored-database-privileges.md:253-254,
collector/README.md:39-43, docs/admin-guide/connections.md:42-54 and :243-245,
and docs/developer-guide/collector/probe-reference.md:6-12, using concise valid
link aliases or destinations without splitting hyperlink syntax.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 7a7ba4a1-6834-4976-9983-67d2b6e00304

📥 Commits

Reviewing files that changed from the base of the PR and between 19c645d and 34cc240.

📒 Files selected for processing (7)

• collector/README.md
• docs/admin-guide/connections.md
• docs/changelog.md
• docs/developer-guide/collector/probe-reference.md
• docs/getting-started/configuration/collector.md
• docs/getting-started/configuration/monitored-database-privileges.md
• mkdocs.yml