Add shared postgres client package

[reyortiz3]

Summary

Introduces a postgres/ package mirroring redis/: a validated Config, a NewPool factory that wraps pgxpool, and a dynamic-authentication dispatcher with AWS RDS IAM as the first backend.

This is the consolidation point for PostgreSQL connection plumbing currently duplicated in toolhive-registry-server (internal/app/storage/database_factory.go + internal/app/storage/auth/). Additional consumers planned. Schema concerns — migrations, sqlc bindings, application-specific type codecs — stay in each caller.

Public surface

• postgres.Config — pool tuning, app + migration user, DynamicAuth block. Implements slog.LogValuer to redact credentials.
• postgres.NewPool(ctx, *Config, ...Option) — auto-installs a BeforeConnect dynamic-auth hook when DynamicAuth is set.
• Options: WithAfterConnect (for custom type codecs), WithBeforeConnect (escape hatch), WithLogger.
• postgres.NewAuthToken / postgres.NewDynamicAuthFunc — token / hook constructors for callers that need them outside NewPool (e.g. golang-migrate's one-shot connection).
• postgres.StartPoolStatsLogger — opt-in periodic pool-stats emitter.
• postgres.DynamicAuthAWSRDSIAM — Region: "detect" discovers region via IMDS; static regions are used as-is.

Design notes

• Single package, not a sub-package per backend. Adding Vault/GCP-IAM later means a new *backend*.go file and a new dispatcher branch — no API churn at the call sites.
• No mutual-exclusion of Password and DynamicAuth at the library boundary. Some callers want a local-dev static fallback. Mutual exclusion belongs in the consumer's config-validation layer (per registry-server's .claude/rules/secrets.md §4).
• Password is a plain string. Secret-file reads, env-var overrides, and pgpass fallback all stay in the consumer's config loader; this package never opens a file.
• pgxpool.NewWithConfig is lazy. NewPool returns without verifying connectivity; dial errors surface on first acquire, matching pgxpool's design.

Test plan

• task lint — 0 issues
• task test — all packages pass under -race
• task license-check — clean
• Coverage 82.5% (above the 70% bar in CLAUDE.md). Uncovered code is the AWS SDK call sites that require real credentials to exercise.

🤖 Generated with Claude Code

[jhrozek]

Batched review of the postgres/ package. Six findings — two HIGH (DSN injection / pool tuning naming), two MEDIUM (auth-hook composition / SSL default), two LOW (dead nil-check / stability marker). None blocking, but recommend addressing the HIGH and MEDIUM before tagging a release. Test coverage at 82.5% and lint clean.

[reyortiz3]

Pushed 4 commits addressing the HIGH and LOW findings. The two MEDIUMs are still open — counter-proposals below.

Addressed

Finding	Commit	Notes
[HIGH] DSN injection via Host/Database	d6c19e7	Verified both attacks empirically — url.Parse on good.rds@evil:5432 resolves to evil:5432, and a ? in Database produces a second query section that pgx resolves in caller-hostile order. Went with a hybrid fix: structural override of Host/Port/User/Password/Database onto a pgxpool.Config bootstrapped from a minimal sslmode=X DSN (so pgx still translates SSL mode → *tls.Config), plus character-class validation in Validate() so the ConnectionString methods are also safe for migration-tool callers. Also tightened the Port check to 1..65535 to give the uint16 conversion a real invariant.
[HIGH] MaxIdleConns → MinConns	ba45e27	Renamed plus a doc comment that calls out the database/sql contrast for readers carrying that mental model.
[LOW] Dead nil-check	de3e617	Collapsed as suggested.
[LOW] Stability marker + tables	13ca610	Added // Stability: Alpha, plus rows in README.md and CLAUDE.md. Agree redis/ is missing from both — happy to handle as a separate follow-up.

Open — pushing back on both MEDIUMs

[MEDIUM] WithBeforeConnect silently replaces dynamic-auth hook. Agree the silent override is a footgun, but compose-by-default has its own footgun: both hooks write to conn.Password, and which one wins depends on order. The "want to layer metrics on top of auth" case is rare; so is "replace the auth hook entirely." I'd rather error loudly when both cfg.DynamicAuth != nil and WithBeforeConnect are set — force the caller to pick. Callers who really mean to replace the auth hook leave cfg.DynamicAuth = nil and pass their own. No silent failure, no surprising composition order. WDYT?

[MEDIUM] DefaultSSLMode = "require" doesn't verify cert. Agree the comment overstates protection. Less convinced about flipping the default to verify-full:

• verify-full requires a working CA chain. Cloud RDS works (Amazon publishes a bundle), but self-hosted Postgres with a self-signed cert — common in dev/staging — breaks on first run.
• registry-server today uses require. A default flip would silently change behavior on bump unless we also pin SSLMode: "require" at the extraction step.

Proposal: keep require as the library default (least surprise on extraction), drop "safe production default" from the doc, and add a paragraph in doc.go recommending verify-full for production cloud Postgres with CA bundles. Security guidance in the docs, not in a default that breaks dev environments. WDYT?

🤖 Generated with Claude Code

[reyortiz3]

Pushed both MEDIUM fixes — but didn't take the reviewer's suggested shape on either; took the alternatives from my earlier reply instead.

Finding	Commit	Approach
[MEDIUM] WithBeforeConnect silently replaces dynamic-auth	c9327c4	Reject the combination at construction time rather than compose. NewPool returns an error when cfg.DynamicAuth != nil AND WithBeforeConnect is also set. Callers that genuinely want both compose the hooks themselves via NewDynamicAuthFunc + custom hook, then pass the composition with cfg.DynamicAuth = nil. No ambiguous default order; no silent token expiry.
[MEDIUM] DefaultSSLMode = "require" overstates protection	e2caa83	Kept the default value at "require" (flipping to verify-full would silently break self-signed / dev environments on first run). Dropped the "safe production default" wording from the const comment, and added a TLS and SSL Mode section in doc.go that explains the tradeoff and points production cloud-Postgres deployments at verify-full with a CA bundle.

Happy to revisit either if the reasoning doesn't land — open to a compose-by-default WithBeforeConnect if you'd rather not error, and to bumping the default to verify-full if breaking dev environments is acceptable as part of the security stance.

🤖 Generated with Claude Code