fix: make Postgres SSL mode configurable via DATABASE_SSL

[Skeyelab]

Problem

Every Coolify deploy since PR #88 (move auth to Coolify Postgres) has been failing at container startup:

[server] failed to start Error: Client network socket disconnected before secure TLS connection was established
    ...
    at applyCommittedMigrations (/app/server.js:5899:12) { code: 'ECONNRESET' }

Root cause: app/lib/db.ts and server.ts hardcode ssl: 'require', but Coolify's internal/private Postgres container (clawproxy-postgres) does not terminate TLS on the docker-network connection. The TLS handshake gets reset, migrations never run, the healthcheck fails, and Coolify rolls back to the last healthy (stale) container.

This has silently blocked all deploys, including PR #89 (OpenClaw landing page) — which is why https://clawproxy.io/openclaw returns 404 even though it merged and built successfully.

Fix

Add a DATABASE_SSL env var (disable/false to turn SSL off), defaulting to the previous require behavior so externally-hosted Postgres (e.g. Neon) is unaffected.

Deploy follow-up

Set DATABASE_SSL=disable in the Coolify app env once this merges, then trigger a redeploy.

Test plan

• yarn lint
• yarn test:run (285 passed)

[strix-security]

Strix Security Review

No security issues found.

Review summary

This PR makes the Postgres SSL mode configurable via a DATABASE_SSL environment variable (defaulting to the prior require behavior) and adds a static Hermes landing page. The SSL logic in both app/lib/db.ts and server.ts strictly maps the operator-supplied value to either false (only when explicitly set to disable or false) or 'require', preserving a secure default and introducing no attacker-controllable input. The new landing page and home-page link contain only hardcoded markup and placeholder strings, with no dynamic content or user-controlled data reaching any sink. The remaining changes are test-only. No security issues were identified.

_{Updated for d37f8bb.}

---

Reviewed by Strix
_{Re-run review · Configure security review settings}