Enable certificate-only Teleport read-write access to production Postgres

[cooper (czxtm)]

Template's production CNPG cluster has a dedicated read-only Teleport login but lacks the dedicated read-write login used for developer data changes. Add teleport_rw with pg_read_all_data and pg_write_all_data, disabled password authentication, a connection limit of 5, and no elevated role attributes.

Extend the existing certificate rule to exactly teleport,teleport_rw within the existing pod CIDR. The read-only login, application password paths, application ownership, database image, and secrets remain unchanged. Companion darkmatter/gitops PR #340 extends the same access model across the other enrolled clusters and records the access policy.

ArgoCD's template Application automatically applies ops/environments/production from main. Reverting this patch removes the read-write certificate path; verify CNPG role reconciliation and database authentication after deployment or rollback.

Validation:

• YAML parsing and whitespace checks passed. Production Kustomize composition passed strict kubeconform validation: 7 valid resources, zero skipped. The bootstrap Secret used a temporary schema placeholder because the matching SOPS identity was unavailable locally; actual KSOPS decryption remains unverified.
• Bun check, test (15 tests), lint, and formatting checks passed. Existing lint advisories remain. Local Bun was 1.4.3; CI uses the repository's pinned 1.3.14.
• Cargo check, test (11 tests), and formatting checks passed; Nix flake checks passed on aarch64-darwin; Docker Compose configuration passed. Linux Nix systems were omitted locally.
• Independent security and regression reviews approved the production patch. The companion GitOps authentication regression suite passed all 104 tests, including the actual Template overlay.

[linear-code]

ENG-1054