Connect to PostgreSQL using TLS

Now that #10 has given us a sane way to authenticate services, switch to using this for PostgreSQL.

* Drops PGBouncer and connects directly to the PostgreSQL database server.
  * PGBouncer doesn't support TLS, suggests wrapping using Stunnel.
    * Using Stunnel is hacky and adds another failure point.
    * Stunnel doesn't support verifying the CN, so any certificate issued by the PSF CA would be valid.
  * PGBouncer is likely to be a premature optimization at this point, and is likely to be unfriendly to the PostgreSQL server anyways since low traffic applications will end up keeping open connections.
  * Applications which benefit from connection pooling can implement them inside the app.
* Switch PostgreSQL replication to using verified TLS as well.
* Switch PostgreSQL to require TLS for connections.