feat(postgres-cache): map ssl-mode to r2dbc SSLMode (TLS support) (#1)

Consumes CacheProperties.PostgresConfig.sslMode (fireflyframework-cache sibling
PR) and applies it via builder.sslMode(SSLMode.fromValue(...)) when set. Blank/
null keeps the driver default (DISABLE) for back-compat. Fixes the Aurora
rds.force_ssl rejection of the Postgres session/cache store.

Author: angelluismula

src/main/java/org/fireflyframework/cache/config/PostgresCacheAutoConfiguration.java

@@ -20,6 +20,7 @@
 import io.r2dbc.pool.ConnectionPoolConfiguration;
 import io.r2dbc.postgresql.PostgresqlConnectionConfiguration;
 import io.r2dbc.postgresql.PostgresqlConnectionFactory;
+import io.r2dbc.postgresql.client.SSLMode;
 import io.r2dbc.spi.Connection;
 import io.r2dbc.spi.ConnectionFactory;
 import lombok.extern.slf4j.Slf4j;
@@ -81,6 +82,14 @@ public ConnectionFactory fireflyCachePostgresConnectionFactory(CacheProperties p
         if (cfg.getSchema() != null) {
             builder.schema(cfg.getSchema());
         }
+        // TLS: r2dbc-postgresql defaults to DISABLE. Servers that enforce SSL
+        // (e.g. AWS Aurora with rds.force_ssl) reject unencrypted connections
+        // ("no pg_hba.conf entry ... no encryption"). Map the configured mode
+        // when set, so consumers can opt into require/verify-* without a code
+        // change. Blank/null keeps the driver default (disable) for back-compat.
+        if (cfg.getSslMode() != null && !cfg.getSslMode().isBlank()) {
+            builder.sslMode(SSLMode.fromValue(cfg.getSslMode()));
+        }
         if (cfg.getProperties() != null && !cfg.getProperties().isEmpty()) {
             Map<String, String> options = new HashMap<>();
             for (Map.Entry<String, Object> entry : cfg.getProperties().entrySet()) {