Rename roles.password to revealPassword

[andrelandgraf]

Problem

roles.password() reads like a property and is a network call. resetPassword returns a Role whose password field is optional, so callers dig out the secret.

Diagnosis

Two operations that exist to hand back a password returned different types, and one of the names hid that it does I/O.

Interface

Before:

await neon.postgres.roles.password(projectId, branchId, name);
await neon.postgres.roles.resetPassword(projectId, branchId, name);
// Role.password is optional

After:

await neon.postgres.roles.revealPassword(projectId, branchId, name);
await neon.postgres.roles.resetPassword(projectId, branchId, name);

Both resolve to string (or { data, error } when throwOnError is off). A reset response with a missing or empty password is a client NeonError. Readiness polling still runs on the raw operations array before that string is returned.

postgres.roles.password is unpublished as a tool; the hidden selector is now postgres.roles.revealPassword. The resetPassword tool returns the string.

Also in here

• Major changeset for @neon/sdk and @neon/tools.

Verification

• pnpm --filter @neon/sdk test:ci — 146 passed
• pnpm --filter @neon/sdk test:types — 16 passed
• pnpm --filter @neon/sdk build
• pnpm --filter @neon/tools test:ci — 140 passed
• Live e2e not run; call sites updated so they compile.

For your attention

• Breaking: roles.password is gone. resetPassword is no longer a Role.
• No roles.connectionString helper in this PR.