Add secret-safe temporary PostgreSQL access for MCP-managed branches

The MCP can create disposable branches and run execute_sql, but it cannot provide a secret-safe way for a local test process to connect directly to the branch as a scoped PostgreSQL role. The current workaround is to generate a temporary password and submit it inside ALTER ROLE ... PASSWORD through execute_sql. MCP clients may retain the complete resolved tool invocation, causing that plaintext password to remain in session metadata even when it is never printed or returned to the model. This blocks database integration tests that must use native PostgreSQL connections—such as Psycopg or LangGraph checkpointers—to verify real role identity, TLS, ACLs, transaction behavior, and restart persistence. Requested behavior • Integrate Supabase Temporary Access with MCP. • Scope access to an exact branch, PostgreSQL role, and short TTL. • Deliver the credential through a sensitive/non-transcript channel rather than ordinary tool arguments or results. • S…