feat(charms): complete the K8s charm class (13/14)

[marceloneppel]

Issue

Part of the final charm->library migration: the K8s charm class stub becomes the faithful composition root. Final state: no logic charm-side.

Solution

• PostgreSQLK8sCharm: the faithful postgresql cached_property (Service endpoints + app secret), endpoint/replicas builders, TLS/ldap/primary/workload-running properties, the status bridges (refresh-priority set_unit_status, gated set_app_status, set_primary_status_message), the restart seams (request_restart scrape-job refresh + lock, restart_services metrics/LDAP pebble restarts with the rotated-password check), update_config (per-relation map + async endpoints + DeployedWithoutTrustError blocking + the DPE-10203 standby_cluster clearing), _on_config_changed/_on_databases_change, fix_leader_annotation, on_deployed_without_trust, the pebble-layers replan guard, fix_pod, push/clean CA file, and the TLS reload bridge (trust-store sync then reload).
• K8sWorkload.generate_metrics_service gained the DATA_SOURCE_* env (charm fidelity).
• The thin consuming charm constructs the COS requirers (metrics/grafana/loki), the TLS-transfer handler, and the rolling-ops lock; all injected as optional ctor params (the vm_charm precedent).
• The conftest harness repoints the charm-local Patroni CA bundle for the unit suite (the k8s reload bridge writes it on every tls_files_pushed; the real /tmp path is read by PatroniManager's verify= in unrelated k8s-leg tests — order-dependent pollution, now guarded).
• Tests: tests/unit/test_k8s_charm.py (19 cases).

Checklist

• I have added or updated any relevant documentation.

• I have cleaned any remaining cloud resources from my accounts.

• Additional commit: fix(workload) — the K8s log-symlink target dropped a duplicated 16/main segment (K8S_*_LOGS_PATH literals already carry the version prefix; the charm passes the full path as the ln target). Pre-existing trunk bug surfaced by the retained charm create-pgdata suite.