Password management

We need to provide some basic tooling surrounding password management. We have a decent process in place for seeding the initial credentials, but the process for managing these credentials long-term is still a little hairy.

I think one simple thing we could do is provide an `fly postgres changepassword ` command that streamlines the change password process for users and ensures it's performed in a safe manor.

One big question is whether or not it makes sense to provide everyone `superuser` privileges, by default?

When a new PG cluster is created, users are required to specify their credentials via secrets. Once the provision has completed, users are supplied with a `postgres` user with _superuser_ privileges. The problem is that once users connect, they have the ability to delete users and change passwords via the `ALTER USER` command. If this is used to change the `flypgadmin`, `repluser` or the `postgres` user credentials, it will create a disconnect between the supplied secrets and the actual credentials used by PG. This could inadvertently bring down their cluster.

We have quite a few different routes we could potentially take here:

1. We provide `superuser` privileges and accept the possibility that people inadvertently break their cluster.
2. We provide a normal user by default, which has privileges to create databases, roles, login, etc. and document how to access the `superuser` if required for their use-case.
3. We restrict PG clusters to normal users and `superusers` are reserved for internal administration.
4. ?

I would love peoples thoughts on this.