refactor(postgres): Wire projectionFormat through ProjectionProvider and PrefixProvider.

Replaces the inline secret-resolution logic in projectionFormat with the generic secret.ProjectionProvider and secret.PrefixProvider types introduced earlier. newProjectionFormat now resolves the PostgreSQLProjection upfront (returning an error immediately on invalid config) and stores a pre-built secret.Provider chain — PrefixProvider("postgresql/", ...) wrapping a ProjectionProvider — on the struct. resolveSecret and resolveConfigKey are simplified to delegate directly to that provider, removing the inline path-assembly, the strings.Contains path-traversal guard (now redundant since ProjectionProvider resolves the key name from the proto descriptor), and the secretRef *string parameter from resolveConfigKey.

Changes newPSQLFormat to return (psqlFormat, error) so that projection() failures (unknown format, missing CUSTOM projection) are surfaced before DSN is called. client.go and client_test.go are updated accordingly. The hostArgs and portArgs struct fields are renamed from *Conf/*Proj to *Config/*Secret for clarity.

Replaces the package-local ErrSecretProjectionMissing sentinel with secret.ErrProjectionMissing from the shared secret package.