TLS support for Postgres connections (sslmode semantics)

Not planned for near-term implementation — tracking issue.

The engine currently connects to Postgres without TLS support. Most managed Postgres providers (RDS, Cloud SQL, Supabase, Neon) require or strongly default to TLS, so this gates deployments against them.

Scope when picked up: rustls-based TLS in tokio-postgres with psql-compatible `sslmode` semantics — `disable` / `prefer` (attempt TLS, fall back to plain) / `require` (TLS, no cert verification) / `verify-full` (CA file + hostname), including SNI (Neon needs it even with verify-none). Upstream reference: sync-service `connection/manager/connection_resolver.ex` (also covers the IPv6→IPv4 fallback pattern worth copying at the same time).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Start by locating the current Postgres connection setup and read sync-service's connection/manager/connection_resolver.ex for the referenced IPv6→IPv4 fallback pattern. The work is done when tokio-postgres supports rustls TLS with psql-compatible disable, prefer, require, and verify-full semantics, including CA handling and SNI for Neon.

Written by the indexing model from the issue text.