app DB pool disables certificate verification (ssl.rejectUnauthorized false) - encrypted but unverified, and the fix needs DATABASE_URL's real host first

MEASURED, not inferred. app/src/lib/db.ts:32 builds its Pool with ssl: { rejectUnauthorized: false } on pg ^8.22.0. That is NOT terra's case: terra's src/db/pool.ts has no ssl object at all, and node-postgres with no ssl config negotiates no TLS, so terra is cleartext. Enamel passes an ssl object, so the app's connection IS encrypted - the residual here is NO CERTIFICATE VERIFICATION, which is the same gap just closed on ENAMEL_OUTBOX_DSN and is a weaker finding than cleartext. Do not let the fleet sweep record enamel's app as cleartext; it is not. WHAT IS ALREADY PROVEN: /home/rob/.config/postgres/prod-ca-2021.crt validates aws-1-sa-east-1.pooler.supabase.com:5432 under sslmode=verify-full from venus, and the control was forced to fail (a bad sslrootcert path refuses the connection outright), so verify-full is enforced there rather than silently accepted. WHAT BLOCKS THE APP-SIDE FIX AND IS THE ONLY OPEN QUESTION: I cannot read DATABASE_URL. Vercel holds it write-only - vercel env pull returns it as a value while CRON_SECRET and the SMTP trio come back as empty strings, but I have not re-read it this session and must not assume the host. verify-full checks the HOSTNAME too, so if the app connects through the transaction pooler (:6543) or a different host than the one the CA was verified against, shipping ssl: { ca } turns every query in production into a connection error at once. That is the whole blast radius: db.ts is the single pool for the entire app. DO NOT SHIP BLIND. Sequence: (1) establish which host+port DATABASE_URL actually names; (2) verify that exact endpoint from venus with psql sslmode=verify-full and the same CA, forcing the bad-CA control to fail; (3) only then replace rejectUnauthorized: false with ssl: { ca: <bundled cert>, rejectUnauthorized: true } and bundle the CA into the deployment; (4) push and confirm a real query path, not a build success - a bad cert fails at CONNECT time, so a green build proves nothing.