Add cross-provider database query access

[davejohnson]

Summary

• route operation-scoped database access through the database-adapter boundary
• keep Railway's temporary TCP proxy behavior while adding a local authenticated connector for Cloud SQL
• add Amazon RDS support with a temporary caller IPv4 /32 security-group rule that is revoked after the query
• use Supabase's existing reachable direct or pooled endpoint without creating temporary infrastructure
• register RDS in desired state and add provider-specific credential and permission guidance

Impact

hv_db_query can now acquire and release the appropriate bounded access mechanism for Railway, Google Cloud SQL, Amazon RDS, and Supabase. Cleanup removes only access Hypervibe created, and concurrent calls continue to share a short-lived lease.

Private-only Cloud SQL and RDS instances still require an existing network path. The diagnostic call does not silently create a billable bastion, proxy, or durable network exposure.

Validation

• npm test — 111 files, 946 tests passed
• focused provider tests — 5 files, 51 tests passed
• npm run typecheck
• npm run build
• git diff --check

Provider API calls are mocked in the automated tests; this change did not modify live database infrastructure.