[DPE-10841] feat(database): relation user lifecycle and blocking statuses (2/7)

[marceloneppel]

Issue

Second slice of the postgresql_provider.py migration. PR 1 landed the manager's state; this one carries the work it guards: creating and dropping the PostgreSQL user and database behind a client relation, and the blocked-status bookkeeping that decides when a failed request is cleared.

Solution

Adds to managers/database.py:

• get_credentials() / collect_databases() — resolve the requested user and database (including the prefixed db* form), blocking on a forbidden username, an unreadable requested-entity secret, or a prefix shorter than three characters;
• create_relation_user_and_database() and delete_relation_user();
• oversee_users() — drops relation users whose relation is gone, honouring the suppress-oversee-users flag;
• check_for_invalid_extra_user_roles(), check_for_invalid_database_name(), unblock_custom_user_errors(), update_unit_status().

Two divergences are preserved rather than merged, because widening either changes what a live cluster does:

• Which errors block. VM catches the whole PostgreSQLBaseError hierarchy; K8s catches only PostgreSQLCreateDatabaseError, PostgreSQLCreateUserError and PostgreSQLGetPostgreSQLVersionError. Widening K8s would newly block requests that today raise through.
• createdb as an extra user role. VM accepts it even though PostgreSQL reports it as neither a privilege nor a role; K8s rejects it.

One deviation worth calling out: all status writes go through the charm's refresh-aware set_unit_status. The two charms were inconsistent here — VM assigned unit.status directly in _get_credentials while K8s used the helper, and they swapped roles at the end of _unblock_custom_user_errors. Preserving that would mean a substrate branch per call site for a difference neither charm looks deliberate about; the helper is the safer of the two, since it does not overwrite a higher-priority refresh status.

Unit tests are in PRs 5 and 6.

Stacked on 1/7. Next: 3/7.

Checklist

• I have added or updated any relevant documentation.
• I have cleaned any remaining cloud resources from my accounts.