release(secrets-mcp): v0.3.3 — 强制 PostgreSQL TLS 校验

显式引入数据库 TLS 配置并在生产环境拒绝弱 sslmode，避免连接静默降级。同步更新 deploy/README 与运维 runbook，落地 db.refining.ltd 的证书与服务器配置流程。

Made-with: Cursor

crates/secrets-core/src/db.rs

@@ -1,14 +1,45 @@
-use anyhow::Result;
+use std::str::FromStr;
+
+use anyhow::{Context, Result};
 use serde_json::Value;
 use sqlx::PgPool;
-use sqlx::postgres::PgPoolOptions;
+use sqlx::postgres::{PgConnectOptions, PgPoolOptions, PgSslMode};
 
-pub async fn create_pool(database_url: &str) -> Result<PgPool> {
+use crate::config::DatabaseConfig;
+
+fn build_connect_options(config: &DatabaseConfig) -> Result<PgConnectOptions> {
+    let mut options = PgConnectOptions::from_str(&config.url)
+        .with_context(|| "failed to parse SECRETS_DATABASE_URL".to_string())?;
+
+    if let Some(mode) = config.ssl_mode {
+        options = options.ssl_mode(mode);
+    }
+    if let Some(path) = &config.ssl_root_cert {
+        options = options.ssl_root_cert(path);
+    }
+
+    if config.enforce_strict_tls
+        && !matches!(
+            options.get_ssl_mode(),
+            PgSslMode::VerifyCa | PgSslMode::VerifyFull
+        )
+    {
+        anyhow::bail!(
+            "Refusing to start in production with weak PostgreSQL TLS mode. \
+             Set SECRETS_DATABASE_SSL_MODE=verify-ca or verify-full."
+        );
+    }
+
+    Ok(options)
+}
+
+pub async fn create_pool(config: &DatabaseConfig) -> Result<PgPool> {
     tracing::debug!("connecting to database");
+    let connect_options = build_connect_options(config)?;
     let pool = PgPoolOptions::new()
         .max_connections(10)
         .acquire_timeout(std::time::Duration::from_secs(5))
-        .connect(database_url)
+        .connect_with(connect_options)
         .await?;
     tracing::debug!("database connection established");
     Ok(pool)