fix: Properly distribute analytics postgres user

[adskyiproger]

Description

Postgres admin permissions are mixed with analytics user. Goal of this PR is to separate permissions:

• Postgres admin remain responsible for:
  • backup
  • restore
  • migration
• analytics user will be responsible for it's own stuff in countryconfig

Test results

• Provision: https://github.com/opencrvs/opencrvs-farajaland/actions/runs/17857667820
• Deploy: https://github.com/opencrvs/opencrvs-farajaland/actions/runs/17858508225/job/50783066382
• Seed: https://github.com/opencrvs/opencrvs-farajaland/actions/runs/17858727686

Environment is available at: https://fix-analytics.opencrvs.dev/

Checklist

• I have linked the correct Github issue under "Development"
• I have tested the changes locally, and written appropriate tests
• I have tested beyond the happy path (e.g. edge cases, failure paths)
• I have updated the changelog with this change (if applicable)
• I have updated the GitHub issue status accordingly

[Zangetsu101]

I think we are still using ANALYTICS_POSTGRES_USER in some of the compose files, which should be removed if we are gonna generate the username. As during the deploy, it errors if the ANALYTICS_POSTGRES_USER is not present in the github environment currently

[Zangetsu101]

So user name is also rotated?

[naftis]

To be honest, I don't know what is generally the convention. In our codebase we sometimes rotate usernames but for Postgres we haven't yet? Feel free to do like you wish.

May help with onboarding if they don't need to decide username for this?

❗ I don't think setup-analytics.sh supports altering usernames

[adskyiproger]

You are right and static user name will work better,
I did tested data seed, deploy, but just imagine situation when you do rotation every time on real environment?

What will happen after 10 sequential deployments?
10 different users with same privileges

I will drop this line, but where should we store analytics user name?

We are using hardcoded user name for events app and migrator

[naftis]

The roles are altered on setup-analytics.sh, no new ones should be created. So that's fine?

Initially I did write the setup-analytics.sh with events_analytics username to keep up with the convention. I'm not sure why Riku changed it to a variable, maybe to help with the same issue why we now replace the variables in core .sql files?

[adskyiproger]

Kept events_analytics user name for consistency with events_app and events_migratior