postgres: broker personal PostgresAccess through nais API

Goal

Expose an authorized, API-brokered request for time-limited personal Postgres access.

Parent contract: nais/pgrator#145. The API owns authentication, authorization,
audit correlation and creation/replacement/deletion of PostgresAccess; pgrator
owns its reconciliation. The caller must never create or select a Tunnel,
DatabaseRole, target address, port, Kubernetes Secret, or Kubernetes credential.

Acceptance criteria

• Define the API request/result contract using logical Postgres, selected ready
  PostgresInstance, access level, and the CLI WireGuard public key.
• Authenticate the user and authorize team, environment, logical Postgres,
  physical instance and requested access level before creating PostgresAccess.
• Create, observe, replace and delete PostgresAccess through the API's
  Kubernetes broker identity; callers receive no Kubernetes credentials.
• Return connection material only after PostgresAccess is Ready, without
  exposing implementation target details or arbitrary Secrets.
• Correlate audit events across API request, PostgresAccess, durable database
  identity and Tunnel lifecycle.
• Cover unauthorized and caller-supplied-target negative cases.

Dependencies

PostgresAccess implementation in nais/pgrator#144 must merge before an end-to-end
flow can be enabled. Tunnel transport qualification remains a production gate,
not a blocker for this API contract work.

Start with the parent contract in nais/pgrator#145 and the PostgresAccess implementation in nais/pgrator#144; no API files or tests are named. Map the request and result contract to each acceptance criterion, including authorization, brokered lifecycle, readiness-gated connection material, audit correlation, and negative cases.