feat: migrate doc-api to Cloud SQL IAM auth

[panish16]

Summary

Migrates doc-api to Cloud SQL IAM auth, matching the pattern established in `person-search` (PR #9) and `legal-api`.

Changes:

• `config.py`: When `CLOUDSQL_INSTANCE_CONNECTION_NAME` is set, uses `DBConfig` from `sbc-connect-common/cloud-sql-connector` (IAM auth, `pool_pre_ping`, `pool_recycle`, `pool_use_lifo`). Falls back to Unix socket or TCP — no behaviour change without the env var. Adds pool size tuning via `DATABASE_MIN/MAX_POOL_SIZE` etc. Adds `MigrationConfig` for migration jobs.
• `migrations/env.py`: Adds `DATABASE_OWNER_ROLE` support — `SET ROLE` before running migrations so DDL is executed under the owner role, ensuring correct table ownership when the IAM service account runs Alembic.
• `init.py`: `setup_pg8000_close_event_listener` conditional on IAM auth being active.

Why: `doc-api-prod` (`c4hnrd-prod`) is actively hitting `pg8000.exceptions.InterfaceError` on connection pool teardown (scale-to-zero noise) AND on live requests via stale pooled connections. IAM auth via the Cloud SQL Python Connector adds `pool_pre_ping=True` which prevents stale connection reuse at the pool level, not just suppresses the error noise.

Reference: person-search PR #9

---

GCP infra required

• Cloud SQL instance: enable IAM database authentication
• Cloud Run service account: grant `roles/cloudsql.instanceUser` on the Cloud SQL instance
• Cloud SQL: create IAM database user matching the Cloud Run service account email
• Cloud Run (`doc-api-dev`): set the new env vars above

Test plan

• CI passes (linting, unit tests, Docker build)
• Deploy to `c4hnrd-dev` with `CLOUDSQL_INSTANCE_CONNECTION_NAME` set — app starts and connects
• Run migrations via `flask db upgrade` — verify tables owned by correct role (`DATABASE_OWNER_ROLE`)
• No `InterfaceError` in Cloud Run logs at overnight scale-to-zero
• `Suppressed pg8000 InterfaceError on connection close during teardown.` appears in DEBUG logs
• Key API endpoints respond correctly after scale-up from zero