feat(rds-postgres): dedicated AssumeRole IAM role for server and db requirements

[sebastiancorrea81]

Summary

• Gives rds-postgres-server and rds-postgres-db each a dedicated per-cluster IAM role that the nullplatform agent can assume via sts:AssumeRole, mirroring the pattern used by nullplatform/scopes-static-files (static-files/requirements/aws).
• rds-postgres-server/requirements/: now creates its own role (trust policy naming the agent role as principal) and attaches its existing 4 policies (RDS, EC2/SG, S3, Secrets Manager — content unchanged) to it, instead of requiring an externally-supplied role name. variables.tf's name was renamed to cluster_name (module has no live state anywhere in this repo — confirmed via review).
• rds-postgres-db/requirements/: brand-new module, same pattern, plus one new policy (secretsmanager:GetSecretValue, scoped to the nullplatform/rds/* secret-name prefix) that this service's README already documented as required but was never previously codified.
• Out of scope (by design, see spec/plan): granting the agent itself permission to assume these roles, and wiring build_context/entrypoint scripts to actually call sts assume-role — both handled centrally, outside these modules, matching the reference architecture.

Docs

• Design spec: docs/superpowers/specs/2026-07-02-rds-postgres-assume-role-design.md
• Implementation plan: docs/superpowers/plans/2026-07-02-rds-postgres-assume-role.md

Test plan

• tofu init -backend=false && tofu validate passes in databases/rds-postgres-server/requirements
• tofu init -backend=false && tofu validate passes in databases/rds-postgres-db/requirements
• tofu fmt -check -diff clean on both modules
• Both modules independently reviewed (spec compliance + code quality), plus a final whole-branch review — all approved, no Critical/Important blockers remaining

🤖 Generated with Claude Code