Document PostgreSQL secret connections

[willdavsmith]

Summary

Updates the add-connection tutorial for the Kubernetes direct Secret connection pattern.

• Keeps the postgresql producer connection for CONNECTION_POSTGRESQL_HOST, PORT, DATABASE, and USERNAME.
• Authors a collision-safe Radius.Security/secrets resource containing the same password passed by value to PostgreSQL.
• Connects that Secret as postgresqlcredentials, which projects CONNECTION_POSTGRESQLCREDENTIALS_PASSWORD through Kubernetes secretKeyRef without copying the value into Recipe output or plaintext container configuration.
• Fixes the malformed rad deploy shortcode arguments on the published page.
• Documents application lifecycle, version compatibility, Kubernetes scope, and gradual adoption.

Prerequisites and dependencies

Runtime support is provided by radius-project/radius#12709, and Kubernetes Container Recipe support is provided by radius-project/resource-types-contrib#300; both are merged.

The PostgreSQL ownership correction in radius-project/resource-types-contrib#298 is merged. It stops returning the developer-supplied password and connection string from Recipe result.secrets.

This PR depends on radius-project/samples#2656 and remains draft until that sample change lands on edge and its compatible demo image is published.

Platform and adoption scope

Automatic Secret projection requires compatible Radius runtime and Kubernetes Container Recipe versions. Older or mixed environments can retain explicit env.valueFrom.secretKeyRef bindings; this change does not migrate or rewrite existing working models. Azure Container Instances behavior is unchanged.

Validation

• Full repository Bicep validation with the Radius-bundled Bicep CLI
• Embedded app-postgresql.bicep is byte-for-byte identical to samples #2656 at 92ff98ee6454f062970aafcd0daf7aaf820440ff
• Full Hugo production build, including shortcode rendering and internal reference resolution
• Rendered deploy command and connection-variable contract check
• Targeted CSpell check for the changed tutorial
• git diff --check

File change summary

File	Summary of change
docs/content/getting-started/add-connection/_index.md	Explains authored Secret ownership, direct projection, compatibility, and lifecycle; fixes the deploy command.
docs/static/samples/demo/app-postgresql.bicep	Adds the client credential Secret and postgresqlcredentials connection from samples #2656.

[willdavsmith]

This PR depends on radius-project/samples#2656. docs/static/samples/demo/app-postgresql.bicep is intentionally synchronized with that samples change, so the sample-sync check will remain expected-failing until #2656 merges into samples:edge.