fix(iac/azure): AKS DB_PASSWORD_SECRET reads a Secret key that doesn't exist #1115

Found while fixing #893 (PR #1114).

In terraform/modules/compute/azure/aks/main.tf, the API Deployment sets DB_PASSWORD_SECRET from Secret key password, but the Kubernetes Secret it reads stores the value under password_secret_name. The Secret has no password key, so the reference can't resolve and API pods would fail to start. #1114's scheduled-task CronJobs share the same env list, so their pods would fail the same way.

Nothing creates these Kubernetes resources in terraform/environments/azure today (blocked on #372), so this hasn't surfaced. It will as soon as AKS Kubernetes resources are turned on.

Fix: point the env var at the key the Secret actually defines, or rename the Secret key, and add a Terraform test asserting that the referenced key exists in the Secret.