put the postgres credentials somewhere findable

The password now lands in ~/.zshenv as PGHOST/PGPORT/PGUSER/PGPASSWORD, as well as in
~/.pgpass. Asked for on the grounds that it is an easier place to remember, which is a
real requirement — a credential you cannot find is one you will ask about every time.

.zshenv rather than the .zshrc that was asked for, for two reasons, neither about
secrecy:

  - zsh sources .zshrc for INTERACTIVE shells only. Verified: `zsh -c` prints an empty
    PGUSER when it is set there, and the right one from .zshenv. A script, a cron entry
    or an agent turn running psql would silently get nothing.
  - .zshrc is a shared template and seedShellConfig only updates it while it still
    matches byte-for-byte, so members keep their edits. A per-member password in it
    would strand every member on the template they were created with — a silent
    maintenance break rather than a tradeoff.

Both files are still written because they are not redundant: .pgpass is what libpq
reads with no shell involved, so it is the one that works for psycopg, a systemd unit
or a compiled binary. The rotate condition now covers both — either missing means we
cannot reconstruct it from the other, so we regenerate.

Also drops the `head -1 ~/.pgpass` parsing I had put in the zshrc template. It was a
hack, and the values are in the environment before that file is read now anyway.

Verified: zsh sourcing order and both shell types, transpiles. Still no tsgo.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/servers/shell-skel/zshrc

@@ -115,16 +115,13 @@ fi
 #
 # Nobody else can read your data, and you cannot reach Officer's own database.
 #
-# PGHOST is set because Postgres runs in a container published on loopback: there is no unix socket on
-# this machine, and without this psql fails with "No such file or directory", which reads like Postgres
-# is not installed rather than like it is one flag away.
+# Nothing is set here. PGHOST, PGPORT, PGUSER and PGPASSWORD are in ~/.zshenv, which zsh reads before
+# this file and for non-interactive shells too — so scripts and agents get them as well. That is also
+# where to look if you want to read your own password; `cat ~/.zshenv`.
 #
-# Read out of ~/.pgpass rather than hard-coded, for the same reason the PATH lines above are $HOME-relative
-# — one fact, in one place, that cannot come to disagree with itself.
-if [ -f "$HOME/.pgpass" ]; then
-  export PGHOST="${$(head -1 "$HOME/.pgpass")%%:*}"
-  export PGPORT="$(head -1 "$HOME/.pgpass" | cut -d: -f2)"
-fi
+# PGHOST matters more than it looks: Postgres runs in a container published on loopback, so there is no
+# unix socket on this machine, and without it psql fails with "No such file or directory" — which reads
+# like Postgres is not installed rather than like it is one flag away.
 
 # ── Docker ──
 # Officer no longer provisions a rootless daemon per account (2026-08-13) — a Postgres role covers the