Providers read the seat's plans and retire only on the operator's yes, removing the credential

ADR 0570 clauses 2 and 5: gitea, keycloak, postgres and route-adapter read mesh-provisioner.plans and
.provisions instead of the controller's assignments. postgres hands the database to a keeper and drops the
login; keycloak replaces the client's secret and keeps the client, so the data stays (issue 1954, V4).

modules/postgres/cmd/postgres-provider/live_test.go

@@ -86,6 +86,14 @@ func TestLive(t *testing.T) {
 	if err != nil || len(r.Rows) != 1 || cell(r.Rows[0], 0) != "1" {
 		t.Fatal("retiring lost the data:", r, err)
 	}
+	// The login is removed, its database kept by its keeper (ADR 0570 clause 5).
+	if has, _ := c.exists(ctx, "SELECT 1 FROM pg_roles WHERE rolname = "+Literal(p.As)); has {
+		t.Fatal("the retired login is still there")
+	}
+	if has, _ := c.exists(ctx, "SELECT 1 FROM pg_database d JOIN pg_roles r ON r.oid = d.datdba WHERE d.datname = "+
+		Literal(p.As)+" AND r.rolname = "+Literal(p.As+"~retired")); !has {
+		t.Fatal("the database is not its keeper's")
+	}
 	inv, err := a.Inventory(ctx)
 	if err != nil {
 		t.Fatal(err)