fix(deploy): enforce cloud database TLS and bounded initialization

用户直接交办 CP-05：完善 Starter/production 数据依赖配置、迁移超时和初始化验收。现有 PostgreSQL 配置无 TLS/连接超时；Redis 配置缺认证/TLS；迁移 advisory lock 无超时。保留现有一次性管理员契约，增加可验证 provision 命令，不等待云凭据，不伪造云验收。本任务为用户直接交办的队列外 ad-hoc 工作。

No files, tests, or entry points are named. Start by locating the Starter/production dependency configuration and migration initialization path, then inspect the existing one-time administrator contract. Done means PostgreSQL and Redis security settings and connection bounds are enforceable, migration advisory locks have a timeout, and a verifiable provision command exists without requiring or faking cloud credentials.

Written by the indexing model from the issue text.