feat(config): assemble Postgres DB from component env vars

[martinemnoble1]

What

Adds a component branch to the DB selection in config/settings.py between DATABASE_URL and the SQLite default. When PANDDA_DB_HOST is set, the Postgres config is assembled from PANDDA_DB_* parts so the password arrives as its own env var — a Container App secretRef → Key Vault reference to the existing database-admin-password — instead of being baked into a full-URL secret. No full-URL secret is minted and no credential lands in a file or in az ... show output.

Precedence: DATABASE_URL → PANDDA_DB_* (selected by PANDDA_DB_HOST presence) → SQLite.

Vars

var	default	required
PANDDA_DB_HOST	—	yes (selects branch)
PANDDA_DB_USER	—	yes
PANDDA_DB_PORT	5432	no
PANDDA_DB_NAME	reinspect	no
PANDDA_DB_PASSWORD	""	no
PANDDA_DB_SSLMODE	require	no

Notes

• Backward compatible: desktop/SQLite and DATABASE_URL deploys see no change.
• No new deps: psycopg already present in the image.
• server_main.py runs migrate on start, so a fresh Postgres self-migrates (tables only — the database must already exist on the server; deployment ensures that).
• New vars documented in docs/CLOUD_DEPLOYMENT.md.

🤖 Generated with Claude Code