fix(config): harden database pool settings

server/internal/shared/config/config.go

@@ -4,6 +4,8 @@ import (
 	"crypto/tls"
 	"encoding/json"
 	"fmt"
+	"net"
+	"net/url"
 	"os"
 	"strings"
 	"time"
@@ -53,8 +55,16 @@ type DatabaseConfig struct {
 }
 
 func (d DatabaseConfig) DSN() string {
-	return fmt.Sprintf("postgres://%s:%s@%s:%d/%s?sslmode=%s",
-		d.User, d.Password, d.Host, d.Port, d.DBName, d.SSLMode)
+	u := url.URL{
+		Scheme: "postgres",
+		User:   url.UserPassword(d.User, d.Password),
+		Host:   net.JoinHostPort(d.Host, fmt.Sprintf("%d", d.Port)),
+		Path:   "/" + d.DBName,
+	}
+	q := u.Query()
+	q.Set("sslmode", d.SSLMode)
+	u.RawQuery = q.Encode()
+	return u.String()
 }
 
 type RedisConfig struct {

server/internal/shared/config/config_test.go

@@ -27,6 +27,23 @@ llm:
 	}
 }
 
+func TestDatabaseConfigDSNEscapesCredentials(t *testing.T) {
+	cfg := DatabaseConfig{
+		Host:     "db.internal",
+		Port:     5432,
+		User:     "geo",
+		Password: "p@ss:word/with?symbols",
+		DBName:   "geo",
+		SSLMode:  "disable",
+	}
+
+	got := cfg.DSN()
+	want := "postgres://geo:p%40ss%3Aword%2Fwith%3Fsymbols@db.internal:5432/geo?sslmode=disable"
+	if got != want {
+		t.Fatalf("DSN() = %q, want %q", got, want)
+	}
+}
+
 func TestLoadFallsBackToConfigLLMAPIKey(t *testing.T) {
 	t.Setenv("LLM_API_KEY", "")