Support PostgreSQL client certificate authentication

[hbjydev]

Summary

• add optional PostgreSQL SSL mode, root CA, client certificate, and private key configuration
• require client certificate and private key paths to be configured together
• document the environment variables and certificate volume mount for Docker deployments

Root cause

The SQLx connection builder only applied PinePods' core DB_* settings. There was no PinePods configuration path for the client certificate and key required by PostgreSQL mTLS authentication, causing startup to fail with connection requires a valid client certificate.

Verification

• cargo test postgres_connect_options_tests (3 passed)
• cargo check --bin pinepods-api
• docker compose -f deployment/docker/compose-files/docker-compose-postgres/docker-compose.yml config --quiet
• live PostgreSQL 18 mTLS fixture: connection without a client certificate reproduced the reported error; the same SQLx connection path authenticated after configuring DB_SSL_ROOT_CERT, DB_SSL_CLIENT_CERT, and DB_SSL_CLIENT_KEY