[LOW] .env.example: add a production-TLS comment next to sslmode=disable

[ahmedkamalio]

Severity: Low (docs)

• api-server/.env.example:2 — DSN ships sslmode=disable (fine for local
  dev). Add a comment recommending sslmode=require or stricter in
  production.

Noted as a positive during the same review: api-server/auth/service.go:73,103
WithOnError handlers correctly return a generic {"error":"unauthorized"},
not err.Error(), and the api-server hashes passwords with bcrypt and
validates inputs (validate: tags).

Identified during an internal security review of the Gas framework
(2026-07-03).