Keep the reporting database off the public internet

An internal reporting API runs on app-network and connects to Cloud SQL. The inherited Terraform gives reporting-db a public IPv4 address and allowlists an office CIDR, but the project has no private services access connection. Security wants the database reachable only through the VPC without weakening its regional availability, automated backups, or deletion protection.

Repair main.tf so reporting-db has private access through app-network with no public IPv4 address or authorized-network allowlist.

• Use the approved /16 peering range google-managed-services-app-network and ensure database provisioning waits for the private connection.
• Preserve the custom-mode VPC and the database identity, region, PostgreSQL version, tier, regional availability, backups, and deletion protection.