existing CNPG Backup objects still carry plaintext users[].password in status.underlyingResources #4179

Every CNPG Backup created before users[].password was dropped still holds those passwords in cleartext, in status.underlyingResources.

marshalCNPGBackupSnapshot in internal/backupcontroller/cnpgstrategy_controller.go serialises app.Spec.Users whole into the snapshot, and that snapshot is persisted as the Backup's status.underlyingResources. While postgresapp.User carried a Password field, any source whose tenant values supplied passwords produced Backup objects with those passwords readable by anyone holding get backups in the namespace, and by whoever reads the audit log.

#4078 removes the field, so new snapshots stop carrying passwords. Nothing touches the objects already there. No migration, no controller startup pass, and neither the PR body nor docs/operations/backup-classes.md mentions that the old ones are still around.

The restore side unmarshals old snapshots fine, dropping the unknown password key silently, so this is data at rest rather than anything functionally broken.

Verified against merge base e94fcf82 while reviewing #4078, where it is carried as a non-blocking follow-up.

Fix shape: a one-off pass that strips the key from existing Backup statuses, or documented guidance to delete Backups taken before the upgrade. Either way it wants saying out loud in the release note for the breaking change, since an operator upgrading has no reason to suspect the old objects.