feat(bootstrap): postgres data-plane + remote helper (T03)

foundation-postgres (postgres:17, digest-pinned in VERSIONS) on foundation-net,
internal only (5432 unpublished); named volume foundation-postgres-data with
retainOnDelete. The forgejo login role + database are created post-boot by an
idempotent, readiness-gated remote.Command (ADR-007), since 5432 isn't reachable
from the operator. Adds the generator half of credentials.ts (@pulumi/random →
CONTRACT_002 postgres keys) and lib/remote.ts (vmConnection over the VM SSH path).

Live on cx33 Helsinki: container healthy, role 'forgejo' + db 'forgejo' present,
no published ports. Acceptance T03 met.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

bootstrap/package.json

@@ -9,7 +9,10 @@
         "@olsitec/pulumi-vault": "workspace:*",
         "@pulumi/docker": "^4.5.8",
         "@pulumi/pulumi": "^3.138.0",
-        "@pulumi/cloudflare": "^5.45.0"
+        "@pulumi/cloudflare": "^5.45.0",
+        "@pulumi/random": "^4.16.8",
+        "@pulumi/vault": "^4.5.8",
+        "@pulumi/command": "^1.1.3"
     },
     "devDependencies": {
         "@types/node": "^18",