[agammann]

Summary

• Generate a unique PostgreSQL password for each new local setup and write matching POSTGRES_PASSWORD and DATABASE_URL values.
• Require that password in local Compose, remove the Drizzle fallback, and make container verification use the generated credential.
• Document password rotation for existing local volumes and cover setup behavior with focused tests.

Validation

• pnpm lint
• pnpm typecheck
• pnpm test (32 passed, 1 skipped)
• pnpm build:local and pnpm build
• In an isolated Docker Compose fixture, the former repository default failed authentication while the generated credential connected and migrations applied.
• A disposable volume retained a synthetic row after password rotation; its prior password was rejected and the new password read the row.

Existing installations

The setup script preserves an existing .env, and PostgreSQL retains the password in an existing cove-data volume. Follow the rotation steps in docs/development.md for those installations.

CI status

The verify job currently stops at pnpm audit --audit-level=low on two moderate transitive dependency advisories (GHSA-g3hv-75wg-m249 and GHSA-3g3m-2fjr-6pw4). The same command fails with the same advisories on the pinned base commit, and this PR leaves pnpm-lock.yaml unchanged. The local credential change passed the earlier lint, typecheck, tests, browser journey, and secret scan steps; the recovery and source-consumer jobs passed. Dependency remediation is in draft PR #30, whose CI passed. Recheck this PR's full CI after #30 lands.