Task: Simplify production database and deployment environment configuration

Identity

Simplify PostgreSQL connection configuration so DATABASE_URL is the only database connection setting; allow sslmode and optional sslrootcert in that URL while retaining full certificate verification by default.
Remove non-essential production ACK environment and Secret injections while retaining the Go API, Next session, bootstrap, RDS CA mount, and runtime storage settings required by the first deployment.
Synchronize Go/Node clients, ACK checks, deployment documentation, README references, and configuration tests.

Do not weaken TLS verification or introduce InsecureSkipVerify.
Keep local JSON development behavior and existing database pool defaults.
Preserve the existing split topology: Next.js serves pages, Go owns the database and embedded WorkerLoop.
Feature mode may update task-scoped code/deployment/docs, but not canonical .project-docs memory.

Completed the single-variable database contract. Go, the legacy TypeScript adapter, and migration scripts now read TLS settings from DATABASE_URL; production defaults to sslmode=verify-full, and sslrootcert is optional in the URL when the RDS CA is mounted. Separate DATABASE_SSL_MODE/DATABASE_CA_CERT_PATH environment variables are no longer consumed.
Reduced ACK runtime configuration to startup essentials, added the missing GO_BACKEND_HOST=0.0.0.0, removed unused provider/webhook/API-key/legacy worker Secret injections, and retained the CA Secret as a file mount rather than an environment variable.
Updated .env.example, deployment docs, READMEs, ACK assertions, and database configuration tests.

go test ./... passed in backend/.
go test ./internal/postgres passed after the final TLS assertion update.
npm run deploy:check passed (9 ACK manifests).
node --check scripts/postgres-client.mjs passed.
node --check scripts/check-ack-manifests.mjs passed.
git diff --check passed; only Git line-ending warnings were reported.
Full Vitest/Next typecheck was not run because this isolated worktree has no node_modules installation.

Replace all ACK placeholders, especially the RDS CA Secret and the DATABASE_URL values. For strict RDS verification, include ?sslmode=verify-full&sslrootcert=/etc/zhinian/rds/ca.pem in both the Go and migration connection URLs.
Add provider/OSS/API-key/Webhook Secret references only when those optional capabilities are enabled.

None. The deployment simplification is task-scoped; canonical architecture already describes the same two-workload production topology.