Refuse a malformed DATABASE_URL without printing the password

[davidmckayv]

What this changes

addressOf in server/src/db/client.ts takes DATABASE_URL apart before it reaches Bun. When new URL rejected the value, the refusal quoted the whole string back — DATABASE_URL is not a URL: "..." — and DATABASE_URL holds the database password. The string most likely to fail that parse is one with a stray character in the password, so the one line that reported the fault wrote the credential into the log.

It now names the variable and the shape it expects, the way every other refusal in the same function already does (names no host, names no database, ... is not percent-encoded), and never echoes the value.

Pre-existing; surfaced while reviewing #400 (which was careful not to leak, and contrasted with this sibling line).

Where it runs

• New state that outlives a request? None. Boot-time parse of the environment.
• Second replica? Every replica parses its own env the same way.
• Serialised / fanned out / new listener? No.

Boundary and audit

• Gateway path unchanged. No new refusals on acting calls. Nothing new trusted from the client.

Proof

server/tests/db-client-address.test.ts gains a test that a URL with a secret password and an invalid port is refused with a message that does not contain the password; the existing not-a-URL test is updated to the new wording. bun test server/tests/db-client-address.test.ts → 11 pass, 0 fail.