Your company runs an Azure SQL logical server named sql-fin01 that hosts a production database. Security requires all connectivity from an Azure VNet to traverse a private endpoint, and the application connects using the standard SQL connection string. When you create the private endpoint for sql-fin01, which target sub-resource must you select so the private endpoint is provisioned correctly for direct database access?