fix(azure/postgresql): allow deploy role to register resource providers

[tfelix]

The PostgreSQL building block deploy role only granted Microsoft.DBforPostgreSQL/* actions. On a freshly created subscription the DBforPostgreSQL resource provider is not yet registered, and the first deployment fails because the deploy role cannot register it.

Add "*/register/action" so the deploy role can register the required resource providers, matching the pattern already used by the other Azure backplane modules (e.g. storage-account, key-vault).

Florian says this is iimportant.

[github-actions]

Scorecard Check

Scorecard run on commit 83acb342f8bca32eb808909f3e3741436197002c relative to origin/main

📊 meshstack-hub Module Scorecard

Generated: 2026-07-28 | Modules scanned: 1 | Categories: 5

📋 Per-Module Category Summary

Score per category per building block. n/a = category does not apply to this module.

Module	Overall	Core Structure	Integration	Azure Backplane	STACKIT Backplane	Testing
azure/postgresql	🟡 53%	🟡 71%	n/a	🔴 44%	n/a	🔴 33%

⚠️ 1 module has failing checks — failing categories are expanded below.

Core Structure — some checks failing

Basic module file structure and documentation — applies to 1 modules

Module	Score	📦	🔗	📋	📝	🖼️	📌	🔒
azure/postgresql	🟡 71%	✅	❌	❌	✅	✅	✅	✅

Core Structure — Summary

Emoji	Criterion	Coverage	Status
📦	buildingblock/ directory exists	1/1	🟢 100%
🔗	meshstack_integration.tf present	0/1	🔴 0%
📋	buildingblock/APP_TEAM_README.md present (no-integration fallback)	0/1	🔴 0%
📝	buildingblock/README.md with YAML front-matter	1/1	🟢 100%
🖼️	buildingblock/logo.png included	1/1	🟢 100%
📌	buildingblock/versions.tf present	1/1	🟢 100%
🔒	Provider versions use minimum constraint (>=)	1/1	🟢 100%

Integration — not applicable

meshstack_integration.tf conventions — applies to 0 modules

No applicable modules.

Azure Backplane — some checks failing

Azure UAMI-based automation principal conventions — applies to 1 modules

Module	Score	🪪	🚫	🚫	🔑	🔗	⚡	🧹	📤	📍
azure/postgresql	🔴 44%	❌	✅	✅	✅	❌	❌	✅	❌	❌

Azure Backplane — Summary

Emoji	Criterion	Coverage	Status
🪪	Uses azurerm_user_assigned_identity	0/1	🔴 0%
🚫	No azuread_application resources	1/1	🟢 100%
🚫	No azuread_service_principal resources	1/1	🟢 100%
🔑	No azuread_application_password resources	1/1	🟢 100%
🔗	Uses azurerm_federated_identity_credential	0/1	🔴 0%
⚡	workload_identity_federation is non-nullable	0/1	🔴 0%
🧹	No create_service_principal_name toggle	1/1	🟢 100%
📤	Outputs identity (client_id, principal_id, tenant_id)	0/1	🔴 0%
📍	Integration has azure_location	0/1	🔴 0%

STACKIT Backplane — not applicable

STACKIT WIF-based automation principal conventions — applies to 0 modules

No applicable modules.

Testing — some checks failing

End-to-end test coverage — applies to 1 modules

Module	Score	⚙️	🧪	✅
azure/postgresql	🔴 33%	✅	❌	❌

Testing — Summary

Emoji	Criterion	Coverage	Status
⚙️	backplane/ directory (optional tier)	1/1	🟢 100%
🧪	e2e/ test directory exists	0/1	🔴 0%
✅	e2e/ contains .tftest.hcl files	0/1	🔴 0%

[aws-amplify-eu-central-1]

This pull request is automatically being deployed by Amplify Hosting (learn more).

Access this pull request here: https://pr-235.d1o16zfeoh2slu.amplifyapp.com

[florianow]

lgtm