Split database config into DATABASE_* components

Assemble the Postgres DSN from DATABASE_ENGINE/HOST/PORT/NAME/USER/
PASSWORD/OPTIONS so only the password needs to live in a secret; the
rest can go in a ConfigMap. DATABASE_URL remains a full-DSN override
(used by the sqlite test suite). Credentials are percent-encoded, the
port and options are omitted when empty, and the k8s migrate
initContainer now also reads the config ConfigMap.

docker-compose.yml

@@ -4,7 +4,8 @@ services:
     environment:
       POSTGRES_DB: tavolo
       POSTGRES_USER: tavolo
-      POSTGRES_PASSWORD: tavolo
+      # Override via the DATABASE_PASSWORD env var (shell or root .env).
+      POSTGRES_PASSWORD: ${DATABASE_PASSWORD:-password}
     ports:
       - "5432:5432"
     volumes:
@@ -71,7 +72,12 @@ services:
     working_dir: /app
     command: ["aerich", "upgrade"]
     environment:
-      DATABASE_URL: postgres://tavolo:tavolo@postgres:5432/tavolo
+      DATABASE_ENGINE: postgres
+      DATABASE_HOST: postgres
+      DATABASE_PORT: "5432"
+      DATABASE_NAME: tavolo
+      DATABASE_USER: tavolo
+      DATABASE_PASSWORD: ${DATABASE_PASSWORD:-password}
     depends_on:
       postgres:
         condition: service_healthy
@@ -90,7 +96,12 @@ services:
       redis:
         condition: service_healthy
     environment:
-      DATABASE_URL: postgres://tavolo:tavolo@postgres:5432/tavolo
+      DATABASE_ENGINE: postgres
+      DATABASE_HOST: postgres
+      DATABASE_PORT: "5432"
+      DATABASE_NAME: tavolo
+      DATABASE_USER: tavolo
+      DATABASE_PASSWORD: ${DATABASE_PASSWORD:-password}
       # By default the app and browsers reach the mock IdP under the same
       # name (see README /etc/hosts note); override OIDC_ISSUER and
       # OIDC_REDIRECT_URI to use a real provider or a different host port.