Deploy: enforce TLS (sslmode) on every production Postgres connection

[mforce]

Deployment-readiness gap (#244), BLOCKER — flagged by 2 of 3 reviewers.

Problem

No production connection string enforces TLS to Postgres. The provider passes the
string straight to UseNpgsql without checking its SSL posture
(PostgresDbContextConfigurator.cs);
deploy/docker-compose.yml builds a bare
Host=db;Port=5432;Database=…;Username=…;Password=… with no SSL params. A
repo/deploy/docs grep finds zero sslmode/SSL Mode.

Npgsql defaults to SSL Mode=Prefer, which silently falls back to plaintext
if the server allows it and never validates the server certificate. For any managed
Postgres reached over a non-loopback network, the DB password and all farm/customer
PII can travel unencrypted or be MITM'd.

Fix (app-side, portable)

Require at least SSL Mode=Require, preferably VerifyFull with a trusted root
cert + hostname verification, in Production; fail the boot when the effective
connection permits plaintext or an unverified certificate. The trusted-root / CA
bundle and the exact per-host suffix are deploy-repo config.

Verify

Log the effective (redacted) connection string at boot; confirm it still connects
with Require/VerifyFull; confirm an invalid server certificate is rejected.

Part of the #244 deployment-readiness audit; tracked in epic #15.

[mforce]

App-side done — merged in PR #295. In Production the app enforces a fail-closed allow-list TLS floor: only VerifyCA/VerifyFull pass silently, Require boots with a warning (recommending VerifyFull), and everything else — Disable/Allow/Prefer AND any undefined SslMode (e.g. a raw SSL Mode=99) — fails the boot. This eliminates the silent-plaintext BLOCKER (Npgsql's Prefer default would otherwise fall back to plaintext). Database:AllowInsecureConnection is the explicit opt-out for the co-located plaintext compose stack (a real deploy never sets it).

Remaining is deploy config, not app code: choose VerifyFull and supply the host CA bundle in a separate deployment/ops repo (the app already enforces Require as the minimum). Closing since the app-side enforcement is complete and the go-live BLOCKER is cleared; reopen if you'd rather track the VerifyFull/CA step here.