Real Postgres/Hyperdrive driver for control-plane's provisionDatabase/deprovisionDatabase

[JSONbored]

Problem

Split from #7180 — this piece is buildable now, unlike the container/secret-injection pieces which are blocked on open isolation-tier and secret-injection-mechanism decisions. TenantProvisioningDriver.provisionDatabase/deprovisionDatabase (control-plane/src/tenant-provisioning-driver.ts) only has a fake in-memory implementation. The Postgres provider decision is made (Neon + Cloudflare Hyperdrive, decided on #7180) — nothing blocks implementing the real methods.

Area

control-plane/src/tenant-provisioning-driver.ts.

Proposal

Implement provisionDatabase/deprovisionDatabase for real: create/destroy a tenant-scoped Neon database (or branch, if Neon's branching model is used for per-tenant isolation — check Neon's current API for the right primitive), returning connection details routed through Hyperdrive. Keep the fake driver as-is for tests; this adds the real implementation alongside it, selected by whatever mechanism the driver factory already uses (check tenant-provisioning-driver.ts for the existing fake-vs-real selection pattern before inventing a new one).

Deliverables

• Real provisionDatabase/deprovisionDatabase implementations against Neon + Hyperdrive.
• Idempotent create/destroy (matching the fake driver's existing idempotency contract).
• Tests against a real or realistically-mocked Neon API — no live credentials in the test suite.

Resources

• Provisioning core: create/destroy a tenant's Container + Postgres DB #7180 (parent — this is one of its four independently-blocked pieces)
• control-plane/src/tenant-provisioning-driver.ts

Boundaries

Database provisioning only — does not touch container creation or secret injection (separate pieces, both still blocked on open decisions).

maintainer-only — provisions real infrastructure with real credentials, not a build task for a first-pass contributor.

[linear-code]

JSO-5404