A developer must connect a local database client to a PostgreSQL server (port 5432) running on an internal host (db-internal) that is only reachable from a bastion host (bastion.example.com). The database port must not be exposed publicly. Which SSH command creates a secure tunnel so that connecting to localhost:5432 on the developer's workstation reaches the internal database?