Gate postgres telegraf fan-out on reactor-provided minion id

postgres.auth was running an `unless` shell check per up-minion on every
manager highstate, even when nothing had changed — N fork+python starts
of so-yaml.py add up on large grids. The work is only needed when a
specific minion's key is accepted.

- salt/postgres/auth.sls: fan out only when postgres_fanout_minion
  pillar is set (targets that single minion). Manager highstates with
  no pillar take a zero-N code path.
- salt/reactor/telegraf_user_sync.sls: re-pass the accepted minion id
  as postgres_fanout_minion to the orch.
- salt/orch/telegraf_postgres_sync.sls: forward the pillar to the
  salt.state invocation so the state render sees it.
- salt/manager/tools/sbin/soup: for the one-time 3.1.0 backfill, drop
  the per-minion state.apply and do an in-shell loop over the minion
  pillar files using so-yaml.py directly. Skips minions that already
  have postgres.telegraf.user set.

salt/manager/tools/sbin/soup

@@ -490,14 +490,32 @@ up_to_3.1.0() {
 post_to_3.1.0() {
   /usr/sbin/so-kibana-space-defaults
 
-  # Provision per-minion Telegraf Postgres users for every minion known to the
-  # manager. postgres.auth iterates manage.up to generate any missing passwords;
-  # postgres.telegraf_users reconciles the roles and schemas inside the so-postgres
-  # container. Then push a telegraf state to every minion so their telegraf.conf
-  # picks up the new credentials on the first apply after soup.
+  # One-time backfill for minions that existed before the postgres Telegraf
+  # feature shipped. Generate the aggregate pillar on the manager and create
+  # the per-minion DB roles, then fan each minion's cred into its own pillar
+  # file. Going forward the reactor handles each new salt-key accept with a
+  # targeted fan-out, so a manager highstate no longer needs to iterate.
   echo "Provisioning Telegraf Postgres users for existing minions."
   salt-call --local state.apply postgres.auth,postgres.telegraf_users queue=True || true
 
+  AGGREGATE_PILLAR=/opt/so/saltstack/local/pillar/postgres/auth.sls
+  MINIONS_DIR=/opt/so/saltstack/local/pillar/minions
+  if [[ -f "$AGGREGATE_PILLAR" && -d "$MINIONS_DIR" ]]; then
+    for pillar_file in "$MINIONS_DIR"/*.sls; do
+      [[ -f "$pillar_file" ]] || continue
+      mid=$(basename "$pillar_file" .sls)
+      [[ "$mid" == adv_* ]] && continue
+      safe=$(echo "$mid" | tr '.-' '__' | tr '[:upper:]' '[:lower:]')
+      existing_user=$(so-yaml.py get -r "$pillar_file" postgres.telegraf.user 2>/dev/null || true)
+      [[ "$existing_user" == "so_telegraf_${safe}" ]] && continue
+      user=$(so-yaml.py get -r "$AGGREGATE_PILLAR" "postgres.auth.users.telegraf_${safe}.user" 2>/dev/null || true)
+      pass=$(so-yaml.py get -r "$AGGREGATE_PILLAR" "postgres.auth.users.telegraf_${safe}.pass" 2>/dev/null || true)
+      [[ -z "$user" || -z "$pass" ]] && continue
+      so-yaml.py replace "$pillar_file" postgres.telegraf.user "$user" >/dev/null
+      so-yaml.py replace "$pillar_file" postgres.telegraf.pass "$pass" >/dev/null
+    done
+  fi
+
   POSTVERSION=3.1.0
 }