Migrated the Driver and TLS enumerations in the Persistence package to use PostgreSQL instead.

Packages/Persistence/Sources/Public/Enumerations/TLS.swift

@@ -1,9 +1,10 @@
 import NIOSSL
+import PostgresNIO
 
 /// The TLS posture used when connecting to the database.
 ///
-/// The executable derives a posture from its `database.tls` configuration and passes it along as part of ``Configuration``; the MySQL driver
-/// receives the resulting `TLSConfiguration` through ``tlsConfiguration``.
+/// The executable derives a posture from its `database.tls` configuration and passes it along as part of ``Configuration``; the PostgreSQL driver
+/// receives the resulting connection TLS mode through ``postgresTLS()``.
 public enum TLS: Sendable {
 
     /// Connect without TLS, in plaintext.
@@ -13,28 +14,27 @@ public enum TLS: Sendable {
     case prefer
 
     /// Connect only over TLS, refusing the connection when the server offers none.
-    ///
-    /// - Important: the refusal is not yet enforced — until it is, `require` behaves like ``prefer`` and silently falls back to plaintext when the
-    ///   server offers no TLS.
     case require
 
 }
 
-// MARK: - Properties
+// MARK: - Methods
 
 extension TLS {
 
-    /// The NIO TLS configuration passed to the MySQL driver for this posture.
+    /// The connection TLS mode passed to the PostgreSQL driver for this posture.
     ///
-    /// Returns `nil` for ``off`` (connect in plaintext) and the default client configuration for ``prefer`` and ``require``.
+    /// Returns `.disable` for ``off`` (connect in plaintext) and the default client configuration for ``prefer`` and ``require``. The driver enforces
+    /// both semantics natively: `prefer` upgrades to TLS only when the server advertises support and continues in plaintext otherwise, while `require`
+    /// refuses the connection when the server offers no TLS.
     ///
-    /// - Note: the driver gives a supplied configuration ``prefer`` semantics natively — it upgrades to TLS only when the server advertises support,
-    ///   and continues in plaintext otherwise — so `prefer` is fully enforced. `require` maps to the same configuration and therefore currently
-    ///   behaves like ``prefer``: the refusal when the server offers no TLS is not yet enforced.
-    var tlsConfiguration: TLSConfiguration? {
+    /// - Throws: an error when the TLS context cannot be built from the default client configuration.
+    /// - Returns: the connection TLS mode for this posture.
+    func postgresTLS() throws -> PostgresConnection.Configuration.TLS {
         switch self {
-        case .off: nil
-        default: .makeClientConfiguration()
+        case .off: .disable
+        case .prefer: .prefer(try NIOSSLContext(configuration: .makeClientConfiguration()))
+        case .require: .require(try NIOSSLContext(configuration: .makeClientConfiguration()))
         }
     }