Close RAILIANCE-WP-0015-T06 rapp credential-lane binding

Document the one recipe a new rapp uses to acquire runtime secrets:
standing KV secrets bind through a CCR target.rapp, leases through
grant rapp_id. Stamp the existing postgres grants and the qonto
workload CCR. Gate, delivery, and revocation are unchanged.

credential-grants/catalog.yaml

@@ -1,5 +1,5 @@
 version: 1
-updated: "2026-08-10"
+updated: "2026-08-13"
 owner_repo: railiance-platform
 owner_domain: financials
 workplan_id: RAILIANCE-WP-0005
@@ -26,6 +26,7 @@ grant_classes:
 grants:
   - id: rapp-postgres/audit-core-runtime
     title: audit-core runtime PostgreSQL lease
+    rapp_id: rapp-postgres
     status: active
     grant_class: self-service
     credential_type: openbao-database-credential
@@ -65,6 +66,7 @@ grants:
 
   - id: rapp-postgres/audit-core-migration
     title: audit-core migration PostgreSQL lease
+    rapp_id: rapp-postgres
     status: active
     grant_class: self-service
     credential_type: openbao-database-credential