feat: add direct PostgreSQL and ACK deployment support

tests/postgres-client-config.test.ts

@@ -0,0 +1,30 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  createPostgresPool,
+  getScriptDataBackend,
+  quotePostgresIdentifier
+} from "../scripts/postgres-client.mjs";
+
+describe("PostgreSQL script configuration", () => {
+  it("requires an explicit data backend", () => {
+    expect(() => getScriptDataBackend({ NODE_ENV: "test" })).toThrow("ZHINIAN_DATA_BACKEND");
+    expect(getScriptDataBackend({ NODE_ENV: "test", ZHINIAN_DATA_BACKEND: "postgres" })).toBe("postgres");
+  });
+
+  it("rejects connection-string SSL options that could override the verified CA configuration", () => {
+    expect(() => createPostgresPool({
+      env: {
+        NODE_ENV: "test",
+        ZHINIAN_DATA_BACKEND: "postgres",
+        DATABASE_URL: "postgresql://app:secret@rds.example:5432/app?sslmode=no-verify"
+      }
+    })).toThrow("must not contain SSL query parameters");
+  });
+
+  it("quotes PostgreSQL role identifiers without allowing SQL syntax injection", () => {
+    expect(quotePostgresIdentifier("zhinian_app")).toBe('"zhinian_app"');
+    expect(() => quotePostgresIdentifier('app"role')).toThrow("identifier");
+    expect(() => quotePostgresIdentifier("bad\0role")).toThrow("identifier");
+  });
+});