Document PostgreSQL secret connections

[willdavsmith]

Summary

Updates the add-connection tutorial for the Kubernetes direct Secret connection pattern.

• Keeps the postgresql producer connection for CONNECTION_POSTGRESQL_HOST, PORT, DATABASE, and USERNAME.
• Authors a collision-safe Radius.Security/secrets resource containing the same password passed by value to PostgreSQL.
• Connects that Secret as postgresqlCredentials, which projects CONNECTION_POSTGRESQLCREDENTIALS_PASSWORD through Kubernetes secretKeyRef without copying the value into Recipe output or plaintext container configuration.
• Fixes the malformed rad deploy shortcode arguments on the published page.
• Documents application lifecycle, version compatibility, Kubernetes scope, gradual adoption, and the demo's intentional display of connection values.
• Removes screenshots of the obsolete single-connection model instead of presenting stale UI evidence.

Prerequisites and dependencies

Runtime support is provided by radius-project/radius#12709, and Kubernetes Container Recipe support is provided by radius-project/resource-types-contrib#300; both are merged.

The PostgreSQL ownership correction in radius-project/resource-types-contrib#298 is merged. It stops returning the developer-supplied password and connection string from Recipe result.secrets.

This PR depends on radius-project/samples#2656 and should merge after that sample change lands on edge and its compatible demo image is published.

Platform and adoption scope

Automatic Secret projection requires compatible Radius runtime and Kubernetes Container Recipe versions. Older or mixed environments can retain explicit env.valueFrom.secretKeyRef bindings; this change does not migrate or rewrite existing working models. Azure Container Instances behavior is unchanged.

Validation

• Full repository Bicep validation with the Radius-bundled Bicep CLI
• Embedded app-postgresql.bicep is byte-for-byte identical to samples #2656 at a10bb60c7c36d5d88c1a25647bb21134499efbc7 (SHA-256 c4da3b360e76c0d69af665629ab6fa9ed467fc054bb7bca8a91595c9f4360df2)
• Full Hugo production build, including shortcode rendering and internal reference resolution
• Rendered deploy command and connection-variable contract check
• Targeted CSpell check for the changed tutorial
• git diff --check
• Sample-sync comparison (expected to differ only until samples #2656 lands on samples:edge)

File change summary

File	Summary of change
docs/content/getting-started/add-connection/_index.md	Explains authored Secret ownership, direct projection, compatibility, lifecycle, and demo visibility; fixes the deploy command and inspection steps.
docs/content/getting-started/add-connection/dashboard.png	Removes the stale single-connection Dashboard screenshot.
docs/content/getting-started/add-connection/todolist.png	Removes the stale single-connection demo screenshot.
docs/static/samples/demo/app-postgresql.bicep	Mirrors the client credential Secret and postgresqlCredentials connection from samples #2656.

[willdavsmith]

This PR depends on radius-project/samples#2656. docs/static/samples/demo/app-postgresql.bicep is intentionally synchronized with that samples change, so the sample-sync check will remain expected-failing until #2656 merges into samples:edge.