feat(consul-postgres-ha): platform sidecar generates everything from SERVICES_JSON

mesh-sidecar/entrypoint.sh now loops over SERVICES_JSON to provision
loopback aliases, render Consul service+sidecar registrations, launch
per-backend Envoy supervise loops, and compute MESH_CONN_ALLOWLIST —
all from the one cluster.tf declaration. The two copy-pasted Envoy
blocks (webdemo + postgres) collapse into one parameterized loop;
--base-id and --admin-bind allocate per-backend.

Two registration patterns fall out automatically:

  A. registers_parent=true  — platform owns parent service AND its
                              sidecar (webdemo-style); Connect.SidecarService
                              inline.
  B. registers_parent=false — workload auto-registers parent under its
                              scope; platform stands up a standalone
                              connect-proxy pointing at it. Workload owns
                              role-tag mutation on the sidecar.

The Patroni role-watcher moves verbatim to patroni/entrypoint.sh
(pattern B's "workload owns its tags" clause). webdemo/main.go drops
all Consul HTTP/SDK calls — the binary now just binds 127.0.0.1:8080
and serves; registration is the platform's job.

`grep -i patroni mesh-sidecar/entrypoint.sh` returns nothing — zero
workload-specific code paths in the platform sidecar.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: h4x3rotab