Document Render Aiven CA setup

[Drew-Z]

What changed

• pins the Aiven project CA path in the Render Blueprint
• documents the required Render secret file name and Free-plan shutdown-delay limitation

Why

The live Aiven PostgreSQL service uses a private project CA. TLS verify-full correctly rejects the connection unless Render mounts that CA at the configured path. Render also rejects maxShutdownDelaySeconds on Free services even though standalone Blueprint validation accepts it.

Validation

• npm run test:community-api:ci (210 passed)
• Render Blueprint validation
• live Render deployment and Community API smoke checks