Support separate datastore URIs for migrations and application

[ivanauth]

Summary

Adds support for separate database connection strings for migrations versus normal SpiceDB operation.

Fixes #338

Motivation

Database migrations require elevated privileges (CREATE TABLE, DROP TABLE, ALTER TABLE) that the SpiceDB application shouldn't have during normal operation. This follows security best practices by allowing least-privilege credentials for the application.

Changes

• Add migration_datastore_uri secret key support
• When present, migration jobs use migration_datastore_uri instead of datastore_uri
• SpiceDB application pods continue using datastore_uri
• Add example and documentation in examples/separate-migration-datastore-uri/

Usage

apiVersion: v1
kind: Secret
metadata:
  name: spicedb-config
stringData:
  # Used by SpiceDB pods - limited privileges
  datastore_uri: "postgresql://app_user:pass@postgres:5432/spicedb"
  
  # Used by migration jobs - elevated privileges
  migration_datastore_uri: "postgresql://admin_user:pass@postgres:5432/spicedb"
  
  preshared_key: "secret"