fix: escape database URL for Alembic config

[afaryy]

Summary

• escape percent signs before passing DATABASE_URL into Alembic configparser-backed configuration
• keep runtime application DATABASE_URL handling unchanged
• add a backend regression test using a synthetic percent-encoded password value

Root cause

Alembic's config.set_main_option uses Python configparser interpolation. Percent-encoded characters in DATABASE_URL, such as %2B or %25, must be escaped as %% before being stored in the Alembic config object.

Validation

• backend pytest
• backend ruff
• Alembic history check
• git diff --check

Not included

• no Terraform changes
• no CloudFormation changes
• no GitHub workflow changes
• no frontend changes
• no AWS resources, deployments, or migrations run

Follow-up after merge

• publish a new backend image from main
• rerun the database migration workflow with the new backend digest/source_commit
• deploy the backend after migration succeeds

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud