Update PostgreSQL demo secret connection

[willdavsmith]

Summary

Updates the getting-started PostgreSQL demo to use the newly merged direct Radius.Security/secrets connection contract on Kubernetes.

• Authors a separate postgresql-client-credentials-* Radius Secret containing the same developer-supplied password passed by value to PostgreSQL.
• Keeps the postgresql database connection for host, port, database, username, and dependency ordering.
• Adds the postgresqlcredentials Secret connection, which projects CONNECTION_POSTGRESQLCREDENTIALS_PASSWORD through a Kubernetes secretKeyRef.
• Prefers the new variable while retaining CONNECTION_POSTGRESQL_PASSWORD as an older/mixed-installation fallback; conflicting values fail explicitly.

Reason for change

radius-project/radius#12709 and radius-project/resource-types-contrib#300 added direct Secret connection projection. radius-project/resource-types-contrib#298 corrected PostgreSQL secret ownership so the Recipe no longer returns the developer-supplied password as a managed output. The demo now supplies that credential through its own Secret.

This remains backward compatible while installations transition: older PostgreSQL Recipes continue to provide CONNECTION_POSTGRESQL_PASSWORD, newer Kubernetes Recipes provide CONNECTION_POSTGRESQLCREDENTIALS_PASSWORD, and matching values are accepted when both are present. The new direct Secret projection is Kubernetes-only; Azure ACI connection behavior is unchanged.

The repository's Build samples workflow builds ghcr.io/radius-project/samples/demo:latest for pull requests without pushing it. A push to edge builds and publishes that latest tag, so no image was manually published for this PR.

How to test

• npm run build in samples/demo
• Runtime assertions for preferred, fallback, matching dual-value, and conflicting dual-value password cases
• BICEP_PATH="$HOME/.rad/bin" python3 ./.github/scripts/validate_bicep.py
• bicep format samples/demo/app-postgresql.bicep --stdout diff check
• git diff --check

The PR image build and Bicep validation pass. The K3D sample-test matrix currently fails during shared Radius setup before app deployment (unknown flag: --preview for preview samples and missing default resource group for legacy samples), unrelated to this change.

File change summary

File	Summary of change
samples/demo/app-postgresql.bicep	Adds a collision-safe client credential Secret and direct Secret connection.
samples/demo/src/db/repository.ts	Prefers the new password variable, retains the legacy fallback, and rejects conflicts.
samples/demo/README.md	Documents the Kubernetes prerequisite, variable contract, fallback, and ACI scope.