fix: address remaining PR review comments (clippy, TODO, secrets backend ordering)

- Fix empty line after doc comment (clippy: empty_line_after_doc_comments)
- Collapse nested if in optional_env overlay check (clippy: collapsible_if)
- Remove dangling TODO(#XX) placeholder issue ref in channels.rs
- Fix init_secrets_context to respect selected database_backend when both
  postgres and libsql features are compiled, preventing wrong-backend
  secrets storage when DATABASE_URL is set but libsql was chosen

Co-Authored-By: Claude Opus 4.6 <[email protected]>

src/config.rs

@@ -883,7 +883,6 @@ impl std::fmt::Debug for SecretsConfig {
 /// Avoids re-prompting the OS keychain on every `SecretsConfig::resolve()` call
 /// (e.g. `Config::from_env()` then `Config::from_db()`). Thread-safe alternative
 /// to caching in a process env var.
-
 impl SecretsConfig {
     /// Auto-detect secrets master key from env var, then OS keychain.
     ///
@@ -1419,10 +1418,8 @@ fn optional_env(key: &str) -> Result<Option<String>, ConfigError> {
     }
 
     // Fall back to thread-safe overlay (secrets injected from DB)
-    if let Some(map) = INJECTED_VARS.get() {
-        if let Some(val) = map.get(key) {
-            return Ok(Some(val.clone()));
-        }
+    if let Some(val) = INJECTED_VARS.get().and_then(|map| map.get(key)) {
+        return Ok(Some(val.clone()));
     }
 
     Ok(None)

src/setup/channels.rs

@@ -623,7 +623,7 @@ pub async fn setup_wasm_channel(
         print_success(&format!("{} saved to database", secret_config.name));
     }
 
-    // TODO(#XX): Substitute secrets into the validation URL and make a
+    // TODO: Substitute secrets into the validation URL and make a
     // GET request to verify the configured credentials actually work.
     if let Some(ref validation_endpoint) = setup.validation_endpoint {
         print_info(&format!(

src/setup/wizard.rs

@@ -1116,17 +1116,46 @@ impl SetupWizard {
             crypto
         };
 
-        // Create backend-appropriate secrets store
-        #[cfg(feature = "postgres")]
+        // Create backend-appropriate secrets store.
+        // Respect the user's selected backend when both features are compiled,
+        // so we don't accidentally use a postgres pool from DATABASE_URL when
+        // libsql was chosen (or vice versa).
+        let selected_backend = self
+            .settings
+            .database_backend
+            .as_deref()
+            .unwrap_or("postgres");
+
+        #[cfg(all(feature = "libsql", feature = "postgres"))]
         {
-            // Try postgres path first when postgres feature is available
+            if selected_backend == "libsql" {
+                if let Some(store) = self.create_libsql_secrets_store(&crypto)? {
+                    return Ok(SecretsContext::from_store(store, "default"));
+                }
+                if let Some(store) = self.create_postgres_secrets_store(&crypto).await? {
+                    return Ok(SecretsContext::from_store(store, "default"));
+                }
+            } else {
+                if let Some(store) = self.create_postgres_secrets_store(&crypto).await? {
+                    return Ok(SecretsContext::from_store(store, "default"));
+                }
+                if let Some(store) = self.create_libsql_secrets_store(&crypto)? {
+                    return Ok(SecretsContext::from_store(store, "default"));
+                }
+            }
+        }
+
+        #[cfg(all(feature = "postgres", not(feature = "libsql")))]
+        {
+            let _ = selected_backend;
             if let Some(store) = self.create_postgres_secrets_store(&crypto).await? {
                 return Ok(SecretsContext::from_store(store, "default"));
             }
         }
 
-        #[cfg(feature = "libsql")]
+        #[cfg(all(feature = "libsql", not(feature = "postgres")))]
         {
+            let _ = selected_backend;
             if let Some(store) = self.create_libsql_secrets_store(&crypto)? {
                 return Ok(SecretsContext::from_store(store, "default"));
             }