refactor(db): parse DSN when defaulting postgres sslmode

[madhavilosetty-intel]

setupHostedDB concatenated "?sslmode=disable" onto DB_URL, which forced plaintext for schema migrations and produced a malformed DSN when the URL already carried a query string.

Parse the DSN(Data Source Name) and only default sslmode when the operator hasn't set one, so verify-full and sslrootcert pass through untouched while the plaintext dev/compose Postgres keeps working.

[codecov]

Codecov Report

❌ Patch coverage is 70.00000% with 6 lines in your changes missing coverage. Please review.
✅ Project coverage is 50.14%. Comparing base (2296f65) to head (5490454).

Files with missing lines	Patch %	Lines
internal/app/migrate.go	0.00%	6 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1199      +/-   ##
==========================================
+ Coverage   50.09%   50.14%   +0.04%     
==========================================
  Files         146      147       +1     
  Lines       13552    13564      +12     
==========================================
+ Hits         6789     6801      +12     
  Misses       6171     6171              
  Partials      592      592              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

This PR refactors Postgres migration DSN handling to avoid forcing sslmode=disable (and producing malformed URLs) by parsing the DSN and only defaulting sslmode when it’s not explicitly provided.

Changes:

• Added applySSLMode to parse a Postgres URL and default sslmode=disable only when absent.
• Updated hosted DB migration setup to use applySSLMode instead of string concatenation.
• Added unit tests for applySSLMode and documented DSN TLS examples in .env.example.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
internal/app/migrate.go	Introduces applySSLMode and applies it before running Postgres migrations to avoid malformed DSNs and preserve explicit TLS settings.
internal/app/migrate_test.go	Adds table-driven tests covering sslmode defaulting/passthrough and malformed URL behavior.
.env.example	Adds documentation guidance for Postgres TLS configuration via DB_URL.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

Suppressed comments (1)

pkg/db/dsn_test.go:46

• The non-Postgres DSN test case includes embedded credentials in the MongoDB URL (it’s being redacted in tooling output). Even in tests, using password-like literals can trigger secret-scanning false positives and accidental copy/paste into real configs. Use a credential-less DSN or obvious placeholders (e.g., user:pass) to keep the intent without looking like real secrets.

		{
			name:     "non-postgres dsn is passed through untouched",
			url:      "mongodb://mongoadmin:admin123@localhost:27017/?authSource=admin",
			expected: "mongodb://mongoadmin:admin123@localhost:27017/?authSource=admin",
		},