Delivery reads cannot go to a read replica, so reads only scale by growing the primary

Reads and writes share one connection string, so a read-heavy deployment scales only by making the primary bigger. For a workload that is almost entirely public reads, that is the wrong axis.

## What to add

A second connection string for delivery reads, pointed at a Postgres replica. Writes and anything that has to read its own writes stay on the primary.

## What makes this harder than a second connection string

**Replication lag is visible to the editor.** Publish an entry, then load the public URL to check it, and the replica has not caught up. The editor concludes publishing is broken. Route a read that follows a write by the same caller to the primary, or accept the lag and say so plainly in the docs. This decision is the issue; the plumbing is not.

**Marten's session types are the seam.** `IQuerySession` is already the read-only one and delivery already uses it (`SitemapEndpoint`, the public endpoints). That is the natural place to bind a different store, and it is worth checking that no delivery path takes an `IDocumentSession` when it only reads.

**Tenancy has to survive the switch.** Conjoined tenancy filters by tenant in the query. A second store configured without the same tenancy setup returns every tenant's rows. That is a data exposure defect, not a performance regression, so it needs a test that would fail if the replica store were configured plainly.

## Done when

- Delivery reads go to the replica when one is configured, and to the primary when one is not.
- A test proves a replica-routed query is still tenant-filtered.
- The read-your-own-writes decision is made and documented.

Start with the IQuerySession seam used by SitemapEndpoint and the public delivery endpoints, then inspect how conjoined tenancy is configured for those reads. Decide how read-your-own-writes should behave, document that decision, and add a test proving replica-routed queries remain tenant-filtered. Done means delivery reads use the replica when configured and the primary otherwise.

Written by the indexing model from the issue text.