Postgres connection disables SSL certificate verification unconditionally

[NimeshaKahingala]

What's happening

packages/back-end/src/db.ts:13:

ssl: {
  rejectUnauthorized: false // only use false for self-signed certs
},

This unconditionally disables TLS certificate verification for every Postgres connection, in every environment (local dev and — as far as this config file shows — production too, since there's no environment branching here).

Why this is filed separately (not fixed as part of the current cleanup)

dev-docs/CLEANUP_PLAN.md Phase 3 adds a comment explaining why this exists (the current Azure Postgres instance apparently uses a self-signed cert) rather than changing the connection behavior outright — doing that safely requires verifying against the real Azure Postgres instance and its actual certificate, which isn't something to change blind as part of a "don't break anything" cleanup pass.

Suggested follow-up

Either:

• Pin the actual CA certificate for the Azure Postgres instance and set rejectUnauthorized: true with that CA, or
• If Azure's managed Postgres already provides a trusted cert chain (likely, for a managed service), verify whether this override is even necessary — it may be a leftover from an earlier self-hosted/dev setup.