Dynamic PostgreSQL credentials engine. Mounted twice in practice: once at
database/ for config/roles CRUD, once at database/creds/ for
on-demand generation — see secrets-server’s wiring.
A named role: which target DB it applies to, the SQL run to create and
revoke a credential (with {{name}}/{{password}} placeholders), and
how long a generated credential lives before the reaper revokes it.