feat: 接入 Database 三资源 API 与分层绑定协调

确定单库单账号、集群级 Database、资源侧先写绑定和凭据定位合同。领域层承载纯规则，service 协調流程，Kubernetes adapter 负责资源呈现与版本保护。

验证：全量 make test、三轮 race、真实 API server 并发与重启补写、最小 RBAC/watch、lint 和文档检查通过。供应、凭据交付及删除清理尚未实现，保留 DeletionPending/finalizer 边界。

config/rbac/role.yaml

@@ -1,11 +1,51 @@
+---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  labels:
-    app.kubernetes.io/name: ayatori
-    app.kubernetes.io/managed-by: kustomize
   name: manager-role
 rules:
-- apiGroups: [""]
-  resources: ["pods"]
-  verbs: ["get", "list", "watch"]
+- apiGroups:
+  - database.ayatori.ddupan.top
+  resources:
+  - postgresqldatabases
+  verbs:
+  - create
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - database.ayatori.ddupan.top
+  resources:
+  - postgresqldatabases/finalizers
+  - postgresqltenants/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - database.ayatori.ddupan.top
+  resources:
+  - postgresqldatabases/status
+  - postgresqltenants/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - database.ayatori.ddupan.top
+  resources:
+  - postgresqlinstances
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - database.ayatori.ddupan.top
+  resources:
+  - postgresqltenants
+  verbs:
+  - get
+  - list
+  - patch
+  - update
+  - watch