ate-setup: support Cloud SQL via the Cloud SQL Auth Proxy

`hack/install-ate.sh` can back the ateapi store with Cloud SQL (see `tools/setup-gcp/cloud-sql.md`): setting `ATE_API_POSTGRES_CLOUDSQL_INSTANCE` writes the `CSQL_PROXY_*` settings into the
`ate-api-server-envvars` `ConfigMap`, synthesizes a passwordless IAM DSN into the `ate-api-server-secret-envvars` Secret, annotates the KSA for Workload Identity, and patches the Cloud SQL Auth
Proxy in as a native sidecar (`manifests/ate-install/cloudsql/proxy-sidecar-patch.yaml`).

`ate-setup` implements none of this. The `ATE_API_POSTGRES_CLOUDSQL_*` variables are ignored, so `deploy ate-system` on a Cloud SQL cluster deploys the bundled `StatefulSet`. Cloud SQL is still reachable from `ate-setup` today: it honors `ATE_API_POSTGRES_CONNECTION_STRING`, so an instance can be used as a plain external PostgreSQL with a password user and a direct private-IP DSN (`sslmode=require`), and the bundled StatefulSet is correctly skipped. What's missing is the proxy/IAM path — the supported, passwordless configuration — plus the sidecar reconcile and configuration stickiness that come with it.
The divergence is recorded in `cmd/ate-setup/differences.md` ("Cloud SQL is shell-only").

cc: @juli4n