testutil: use RDS-managed password rotation in the Ministack harness

[Kiran01bm]

Summary

Replaces the AWS-boundary harness's hand-rolled password-change seam with the RDS-managed master-password flow Ministack v1.4.15 supports end to end. The rotation test now exercises the same control-plane path production credentials take: managed password generation at cluster creation, Secrets Manager resolution, and RotateMasterUserPassword.

Why

The previous seam pushed a caller-invented password through ModifyDBCluster — a shape real operators using managed passwords never exercise. With Ministack v1.4.15 (pinned by the previous image bump), the emulator implements the managed flow faithfully, so the harness can prove the realistic contract: an in-flight session survives rotation, a stale password fails at the next connect, and the refreshed credentials come from Secrets Manager, not from the test.

What

• CreateDBCluster now sets ManageMasterUserPassword: true instead of passing a fixture password; the harness resolves the generated password by discovering the cluster's MasterUserSecret ARN and reading it through a Secrets Manager client pointed at the same gateway.
• Rotate drops its caller-chosen password parameter: it issues ModifyDBCluster with RotateMasterUserPassword, then polls boundedly until the managed secret resolves to a password different from the pre-rotation one, then until the database accepts it.
• Secret resolution is a non-asserting resolveManagedMasterPassword (returns errors so pollers can retry it) behind a bounded polling helper shared by provisioning and rotation, which reports the last resolution error when the deadline expires.
• Connection URLs are assembled with net/url, so an RDS-generated password containing URL-reserved characters round-trips intact; the cluster-delete cleanup registers before anything fallible touches the cluster.
• Adds aws-sdk-go-v2/service/secretsmanager; smithy-go moves to indirect.

before:  test invents password ──▶ ModifyDBCluster(MasterUserPassword)

after:   CreateDBCluster(ManageMasterUserPassword)
              │
              ▼
         DescribeDBClusters ──▶ MasterUserSecret.SecretArn
              │
              ▼
         Secrets Manager GetSecretValue ──▶ {username, password}
              │
              ▼
         ModifyDBCluster(RotateMasterUserPassword) ──▶ poll secret ≠ old ──▶ poll DB accepts

This PR was authored by Amp (Claude Opus 4.6).

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[morgo]

🤖 Approved by Morgan's AI agent (low-risk review pass): test-harness-only — switches the Ministack Aurora harness to RDS-managed password rotation with Secrets Manager resolution, and hardens connection-URL building with a round-trip escaping test. Only internal/testutil, docs, and go.mod (official AWS SDK secretsmanager module + patch bumps) are touched; CI green on PG 14–18.