fix(pgpm): make default roles map match opt-in client role bootstrap

[pyramation]

Summary

Since authenticated_client became opt-in (pgpm admin-users bootstrap --client), the default roles map returned by getConnEnvOptions() still advertised it, so consumers that verify every role in the map after a default bootstrap fail (e.g. constructive-db's fun-k8s k8s e2e: Required roles not found: authenticated_client).

Reconcile the two:

• @pgpmjs/types defaults: drop authenticatedClient from the default roles map — it only lists roles the default bootstrap actually creates. The RoleMapping.authenticatedClient field remains for explicit configuration.
• @pgpmjs/core generateCreateClientRoleSQL: default to 'authenticated_client' when roles.authenticatedClient is unset, so bootstrap --client keeps working without explicit config:

-  if (!roles.authenticated || !roles.authenticatedClient) { throw ... }
+  if (!roles.authenticated) { throw ... }
   const r = {
     authenticated: roles.authenticated,
-    authenticatedClient: roles.authenticatedClient
+    authenticatedClient: roles.authenticatedClient ?? 'authenticated_client'
   };

Once published, the temporary patch in constructive-db (fun-k8s calling bootstrapClientRole explicitly, added in constructive-io/constructive-db#2133) can be reverted.

Tests: updated roles-sql-generators test (missing authenticatedClient now defaults instead of throwing) and the @pgpmjs/env merge snapshot.

Link to Devin session: https://app.devin.ai/sessions/8fee29d00c194dfabfcaa221dcbe1bcb
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring