security: implement group 1 - database security remaining gaps

[rshade]

Database Security — Remaining Gaps

Reference: security-groups/group-1-database-security.md

Most database security is already implemented in gke-hosted/01-infrastructure/database.ts:

• ✅ CMEK encryption with 90-day key rotation
• ✅ SSL/TLS via sslMode: "ENCRYPTED_ONLY"
• ✅ Backup encryption with 30-day retention, PITR, 7-day transaction log retention
• ✅ Query Insights with IP tracking and slow query logging
• ✅ Private network (ipv4Enabled: false, VPC peering only)
• ✅ Deletion protection
• ✅ 20-char random password with special chars

Remaining work

1. Database Firewall Rules — Restrict authorizedNetworks to GKE cluster subnet CIDR only (defense-in-depth on top of VPC peering)
2. Centralized Audit Log Export — Export Cloud SQL audit logs to Cloud Logging/BigQuery for centralized analysis (currently only visible in Query Insights)

Acceptance Criteria

• authorizedNetworks configured with GKE subnet CIDR
• Cloud SQL audit log sink created targeting BigQuery
• Application connectivity verified unaffected