Clarify IAM auth for Cloud SQL Auth Proxy Unix socket connections

[Copilot]

When Cloud SQL Auth Proxy connects via Unix socket with IAM Database Authentication, the proxy handles auth — DB_PASSWORD is not needed. The previous config example incorrectly included it and omitted DB_USER/DB_NAME.

Changes

• .env.example: Removed DB_PASSWORD; added DB_USER and DB_NAME (required by db.ts); added comment clarifying IAM handles auth
• src/lib/db.ts: DB_PASSWORD is now conditionally applied to the pool config — omitted entirely when not set, rather than passed as undefined

const poolConfig: ConstructorParameters<typeof Pool>[0] = {
  user: dbUser,
  database: dbName,
  host: instanceUnixSocket,
};
if (dbPassword) {
  poolConfig.password = dbPassword;
}

DB_USER remains required — PostgreSQL still needs a role to connect as (the IAM service account name mapped to a PG user). Only the password is unnecessary under IAM auth.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.