Update PostgreSQL demo secret connection

[willdavsmith]

Summary

Updates the getting-started PostgreSQL demo to use the newly merged direct Radius.Security/secrets connection contract on Kubernetes.

• Authors a separate postgresql-credentials-* Radius Secret containing the same developer-supplied password passed by value to PostgreSQL.
• Keeps the postgresql database connection for host, port, database, username, and dependency ordering.
• Adds the postgresqlCredentials Secret connection, which projects CONNECTION_POSTGRESQLCREDENTIALS_PASSWORD through a Kubernetes secretKeyRef.
• Prefers the new non-empty variable while retaining CONNECTION_POSTGRESQL_PASSWORD as an older/mixed-installation fallback; differing non-empty values log a warning and use the new value.

Reason for change

radius-project/radius#12709 and radius-project/resource-types-contrib#300 added direct Secret connection projection. radius-project/resource-types-contrib#298 corrected PostgreSQL secret ownership so the Recipe no longer returns the developer-supplied password as a managed output. The demo now supplies that credential through its own Secret.

This remains backward compatible while installations transition: older PostgreSQL Recipes continue to provide CONNECTION_POSTGRESQL_PASSWORD, newer Kubernetes Recipes provide CONNECTION_POSTGRESQLCREDENTIALS_PASSWORD, and the new non-empty value takes precedence when both are present. The new direct Secret projection is Kubernetes-only; Azure ACI connection behavior is unchanged.

The repository's Build samples workflow builds ghcr.io/radius-project/samples/demo:latest for pull requests without pushing it. A push to edge builds and publishes that latest tag, so no image was manually published for this PR.

How to test

• npm run build in samples/demo
• Runtime assertions for preferred, fallback, empty preferred, and differing dual-value password cases
• BICEP_PATH="$HOME/.rad/bin" python3 ./.github/scripts/validate_bicep.py
• bicep format samples/demo/app-postgresql.bicep --stdout diff check
• git diff --check

Rebased onto current edge, including #2657's explicit Radius environment setup fix. Local formatting, TypeScript/client builds, password compatibility assertions, and Bicep validation pass. Refreshed CI is running.

File change summary

File	Summary of change
samples/demo/app-postgresql.bicep	Adds a consistently named client credential Secret and direct Secret connection.
samples/demo/src/db/repository.ts	Prefers the new non-empty password variable, retains the legacy fallback, and warns on conflicts.
samples/demo/README.md	Documents the minimum release, Kubernetes variable contract, fallback behavior, and ACI scope.

[kachawla]

Looks good. Two follow-ups, neither blocking: the README cites Radius 0.61.0 but the latest release is v0.60.1, so please confirm that is the intended landing release. And app-postgresql.bicep is not in the K3D matrix in .github/workflows/test.yaml, so nothing in CI deploys this Secret connection.