chore: harden production readiness gates and runbooks

backend/providers/postgres/config.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"math"
 	"strconv"
+	"strings"
 	"time"
 
 	"go.ipao.vip/atom/container"
@@ -92,6 +93,8 @@ func (config *Config) checkDefault() {
 
 	if config.SslMode == "" {
 		config.SslMode = "disable"
+	} else {
+		config.SslMode = strings.ToLower(strings.TrimSpace(config.SslMode))
 	}
 
 	if config.TimeZone == "" {
@@ -141,3 +144,9 @@ func (config *Config) DSN() string {
 
 	return base + extras
 }
+
+func (config *Config) IsTLSEnabled() bool {
+	mode := strings.ToLower(strings.TrimSpace(config.SslMode))
+
+	return mode != "" && mode != "disable"
+}