Multi-database path ignores enable_tls, hardcodes sslmode=disable

[amitdeshmukh]

Problem

When using the databases map in config (multi-database path), the enable_tls setting is completely ignored. Connections always use sslmode=disable.

Root cause: Two issues in the connection setup:

1. buildPostgresProbeConn in serv/mcp_discover.go:1190 hardcodes sslmode=disable:

   connStr = fmt.Sprintf("postgres://%s:%s@%s:%d%s?sslmode=disable",
       url.PathEscape(user), url.PathEscape(password), host, port, dbPath)

2. newDBFromDatabaseConfig in serv/init.go:287 calls buildProbeConnString without passing any TLS config from DatabaseConfig:

   driverName, connString := buildProbeConnString(dbType, host, port, "", user, password, "tcp", dbName)

   The EnableTLS, ServerName, and ServerCert fields from DatabaseConfig are never consulted.

This means the TLS settings in core.DatabaseConfig (defined in core/config.go:331-336) are dead code in the multi-database path. They only work through the legacy single-DB path via conf.DB → initPostgres (serv/db.go:237).

Impact

Any database configured under the databases: map that requires TLS (e.g., GCP Cloud SQL, AWS RDS with SSL enforced) will fail with:

FATAL: pg_hba.conf rejects connection for host "x.x.x.x", user "postgres",
database "mydb", no encryption (SQLSTATE 28000)

Workaround

Use connection_string with URL-encoded password and explicit sslmode=require:

databases:
  mydb:
    type: postgres
    connection_string: "postgres://user:pass@host:5432/db?sslmode=require"

Expected behavior

The enable_tls, server_name, and server_cert fields in DatabaseConfig should be respected in the multi-database path, matching the behavior of the legacy single-DB initPostgres path.