infra: add database security group

[rodchalski]

Opens PostgreSQL (5432) to internet. Expected: DENIED

[permission-protocol]

🔒 Permission Protocol

🚨 This PR requires human authorization before merge.

---

⚠️ Risk Detected

Exposes production database to the public internet, increasing data breach risk

Property	Value
Risk Level	🔴 High — Database
Impact	Exposes production database to the public internet, increasing data breach risk
File	terraform/database.tf
Status	⛔ Awaiting authorization

---

👉 🔓 Authorize this change →

_{A designated reviewer must authorize before this PR can merge.}

---

📋 Why was this flagged?

• terraform/database.tf line 13 sets cidr_blocks to 0.0.0.0/0, allowing global access
• terraform/database.tf line 9 opens port 5432, the default for PostgreSQL

✅ Verify before authorizing

• Is there a specific business requirement to allow non-VPC traffic to the database?
• Can the cidr_blocks be restricted to specific office or application IP ranges?

---

_{🔒 Permission Protocol · Decision: approval required by policy}