fix(guided-setup): keep DATABASE_URL_APP empty, harden .env encoding & proxy trust

[ToddHebebrand]

Problem

The guided installer wrote DATABASE_URL_APP as a localhost value, but the bundled docker-compose.yml passes DATABASE_URL_APP straight through to the api container (${DATABASE_URL_APP:-}). So the unprivileged request pool dialed 127.0.0.1 inside the container and crashed at seed/startup with ECONNREFUSED. (DATABASE_URL is fine because compose rebuilds it as …@postgres in-container.)

Fix: leave DATABASE_URL_APP empty so the API derives the breeze_app URL from the container's @postgres DATABASE_URL. Multi-host/HA deployments still set it explicitly by hand.

Additional hardening (surfaced during review)

• TRUST_PROXY_HEADERS: write true (was false), leaving TRUSTED_PROXY_CIDRS empty so compose re-defaults to the pinned Caddy peer (${BREEZE_CADDY_IP:-172.31.0.10}/32). false made the API attribute every request to Caddy's container IP — collapsing per-IP rate limiting, partner/admin IP allowlists, and audit IP attribution (SR2-16; locked by proxyTrustCompose.test.ts).
• External-proxy same-host CIDR: now derives the docker bridge gateway (.1 of BREEZE_DOCKER_SUBNET, default 172.31.0.1) instead of 127.0.0.1, which matched nothing inside the container (packets are NAT'd to the bridge gateway). Uses parameter expansion, not BASH_REMATCH — that's unreliable on macOS bash 3.2.
• .env value encoding: format_env_value single-quotes values without a single quote, else double-quotes and escapes \ " $ \``; strip_wrapping_quotesis the exact inverse (sentinel-protected backslash).get_env_valueonly strips inline#comments on **unquoted** values;set_env_valuepasses the value viaENVIRON, not awk -v(which mangled backslashes). Previously a', space + #, `, or $ in an admin display name or password aborted setup.
• start_stack: checks compose pull / compose up -d exit codes; STACK_STARTED set only on success.
• is_postgres_identifier validates POSTGRES_USER / POSTGRES_DB so both the host .env URL and the compose-built container URL stay well-formed.
• Credential-backup chmod 600 now fails loudly; on_exit sweeps stranded atomic-write temp files (which can hold secrets).

Tests

Two new CI guards, wired into the existing Guard guided setup behavior step:

• check-guided-setup-db-urls.sh — DATABASE_URL_APP is empty and TRUST_PROXY_HEADERS is never false.
• check-guided-setup-env-roundtrip.sh — behavioral .env round-trip over 14 adversarial values (including O'Brien, pass #1, back\slash, a'b\c"d`e$f which exercises the double-quote escape branch). Verified non-vacuous: it fails against the pre-change encoder and against asymmetric mutations of the encode/decode pair, and is green on the fix.

All four guided-setup guards pass; bash -n and shellcheck clean.

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying breeze with    Cloudflare Pages

Latest commit:	84eddd6
Status:	✅  Deploy successful!
Preview URL:	https://26996e11.breeze-9te.pages.dev
Branch Preview URL:	https://fix-guided-setup-db-url-env.breeze-9te.pages.dev

View logs