[lukebuehler]

The Runtime needs TLS support for Azure PostgreSQL and a native Azure Blob backend for payloads above the inline storage limit. Enable SQLx TLS with native CA roots and add Azure account-key/SAS authentication through the existing object-store interface.

• Preserve existing S3 configuration and exports, with S3 and Azure builders in separate modules.
• Validate backend settings before database setup and redact credential debug output.
• Prepare v0.5.1 metadata, lockfile, configuration documentation, and release notes. Database schemas and protocol revisions are unchanged.

Validation:

• cargo clippy --workspace --all-targets --locked -- -D warnings
• Affected Rust unit suites: 481 passed.
• PostgreSQL TLS integration, including rejection of an unrelated CA and incorrect hostname.
• Azure CAS against Azurite with account-key and SAS authentication: large blobs, reconnection, universe isolation, listing, and deletion.
• Built Runtime migration/schema/API-key commands and Platform migrations over verified PostgreSQL TLS.
• Documentation checks, release metadata verification, and release-tool tests.

Actual AKS and managed Azure service connectivity still require deployment validation. Image publication follows the v0.5.1 release process.