Postgres audit URL without sslmode=verify-full permits TLS downgrade + credential theft #149

Red-team finding F6.2 (validated, deferred). PostgresStore::connect_pool passes the operator URL to PgConnectOptions::from_str with no minimum TLS mode; sqlx defaults to Prefer, which silently downgrades to plaintext if the server answers the SSL negotiation with N, exposing the DB credential to an active MITM. Proposed fix: for a TCP (non-Unix-socket) URL with no explicit sslmode>=require, either refuse to start or emit a loud warning, and document verify-full as the recommended mode. Not yet fixed.