Move strr-api deployed DB access to Cloud SQL IAM auth

[Jacky-Pham]

what changed

this moves strr-api from password and socket database auth to Cloud SQL automatic IAM auth using the shared Python Connector and pg8000 setup from bcgov/sbc-connect-common#77.

local development and tests still use the current password settings when Cloud SQL runtime variables are not set.

• DATABASE_USERNAME is used by the api and DATABASE_MIGRATION_USERNAME is used by migrations
• the api now uses the same shared helper and pg8000 close listener as Move remaining STRR services and jobs to Cloud SQL IAM auth #1764
• Alembic keeps ownership on DATABASE_OWNER_ROLE and the migration user uses SET ROLE
• the tests now cover the api wiring, the exact vault values, and a real pg8000 query instead of repeating the shared helper tests

relationship and dependency

this now uses the same Python Connector and pg8000 setup as #1764.

this pr and #1764 do not change the same files, so they can merge in either order after #77 is merged and the pins are updated.

the branch is pinned to the tested #77 commit through my fork for now. #77 needs to merge first, then i will update this to the bcgov merge commit and regenerate the lock before this merges.

before merge

merging to main starts the deploy, so these need to be done first:

• add DATABASE_INSTANCE_CONNECTION_NAME, DATABASE_IAM_USERNAME, DATABASE_MIGRATION_IAM_USERNAME, DATABASE_NAME, and DATABASE_OWNER_ROLE in 1Password
• use bcrbk9-dev for dev, bcrbk9-test for test and uat, bcrbk9-tools for sandbox, and bcrbk9-prod for prod
• make sure the existing migration job uses the new migration image and Cloud SQL variables, and its runtime identity matches DATABASE_MIGRATION_USERNAME, because the deploy only runs the existing job
• make sure both runtime identities have Cloud SQL client access and database login, and the migration identity can SET ROLE strr
• use a full deploy or remove DATABASE_PASSWORD, DATABASE_HOST, DATABASE_PORT, and DATABASE_UNIX_SOCKET because the redeploy path keeps old variables

testing

• full api suite: 526 passed, 6 skipped, 85.63% coverage
• the pg8000 integration test runs a real query against Postgres 16
• shared connector: 21 passed, 3 credential tests skipped
• poetry lock check, black, isort, pylint, and diff check passed

[bcregistry-sre]

Temporary Url for review: https://strr-hosts-dev--pr-1763-ciu8zc70.web.app

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud