fix: add TLS support for PostgreSQL connections (#363) (#427)

All PostgreSQL connection sites hardcoded NoTls, preventing connections
to managed providers that require TLS (AWS RDS, Neon, Supabase, etc.).

- Add tokio-postgres-rustls with rustls + system root certificates
- Add SslMode enum (disable/prefer/require) via DATABASE_SSLMODE env var
- Replace NoTls at all 4 production call sites with TLS-aware pool creation
- Add SslMode::from_env() helper for lightweight CLI tools
- Log native cert loading errors and warn on empty root store

Default mode is Prefer (attempts TLS, matching most managed providers).

Co-authored-by: Claude Opus 4.6 <[email protected]>

src/history/store.rs

@@ -2,10 +2,8 @@
 
 use chrono::{DateTime, Utc};
 #[cfg(feature = "postgres")]
-use deadpool_postgres::{Config, Pool, Runtime};
+use deadpool_postgres::{Config, Pool};
 use rust_decimal::Decimal;
-#[cfg(feature = "postgres")]
-use tokio_postgres::NoTls;
 use uuid::Uuid;
 
 #[cfg(feature = "postgres")]
@@ -50,8 +48,7 @@ impl Store {
             ..Default::default()
         });
 
-        let pool = cfg
-            .create_pool(Some(Runtime::Tokio1), NoTls)
+        let pool = crate::db::tls::create_pool(&cfg, config.ssl_mode)
             .map_err(|e| DatabaseError::Pool(e.to_string()))?;
 
         // Test connection