docs(security): design PostgreSQL datasource TLS trust

[dviejokfs]

Summary

• defines an explicit per-service PostgreSQL TLS policy using the existing encrypted ssl_mode parameter
• removes handshake-driven TLS-to-plaintext downgrade from the proposed connector design
• distinguishes plaintext, encryption-only self-signed TLS, and fully verified platform-trust TLS
• specifies race-safe policy generations, real stale-transport shutdown, strict input/provenance rules, and partial-commit auditing

Security finding

Addresses the design for finding #9: PostgreSQL data-explorer TLS failure silently falls back to plaintext.

Validation

• document whitespace and placeholder checks pass
• repository commit hooks pass
• security-auditor sign-off granted for the ADR design

This PR is documentation only. The eventual implementation remains subject to the ADR regression suite and a separate security review.

[github-actions]

📓 Changelog preview

This is what your commits will add to the generated CHANGELOG.md at release time (via git-cliff). Do not edit CHANGELOG.md by hand — it is generated from your Conventional Commit messages.

## [Unreleased]

### Documentation

- **security:** Design PostgreSQL datasource TLS trust
- **security:** Require TLS at postgres driver layer