feat(minimal): add opt-in DB_SSL_ENABLED for RDS IAM-token auth

[WolfangAukang]

What

Adds an opt-in DB_SSL_ENABLED env var to the simplerisk-minimal entrypoint. When set to exactly true, the privileged setup/delete MySQL client (db_setup() / delete_db()) appends --ssl-mode=REQUIRED --enable-cleartext-plugin.

Why

Required for the EKS per-account migration: the new CDK-provisioned RDS is IAM-auth-only (no master password). Deploy tooling will pass a short-lived RDS IAM auth token via DB_SETUP_PASS; MySQL only accepts a token when the client sends it via the cleartext plugin, which in turn mandates TLS.

Safety — default off, fail-closed

• Only the exact string true enables the flags. Unset / false / any other value ⇒ unchanged plaintext-capable connection.
• No behavior change for any existing consumer of the published image; only our EKS setup/delete Jobs will opt in.

Testing

Built the image from this branch and ran an integration test against a TLS-mandatory MySQL 8.4 (--require_secure_transport=ON). 7/7 passed:

• Flags emitted only when DB_SSL_ENABLED=true (verified via bash xtrace of the real mysql line); absent when unset.
• The server genuinely rejects a non-TLS connection, so the successful runs necessarily used TLS.
• With DB_SSL_ENABLED=true: full setup over the TLS-required server — DB simplerisk and user simplerisk created, container exits 0.
• No regression: with the var unset, setup still works against a plain MySQL.

🤖 Generated with Claude Code