feat(configuration): decompose v3 database configuration

[josecelano]

Summary

Decompose the v3 database configuration into explicit SQLite, MySQL, and PostgreSQL variants.

• Replace the ambiguous path field with Database::{Sqlite3, MySQL, PostgreSQL} and ConnectionInfo.
• Validate driver-specific TOML fields, default omitted network ports, and reject missing or blank network passwords.
• Store the isolated v3 database password as SecretString, redact generic serialization, and retain an authorized persistence path.
• Update v2-to-v3 migration guidance with MySQL, PostgreSQL, and SQLite examples.

Scope boundary

Active runtime consumers, default v2 configuration files, examples, benchmarks, and E2E configuration continue to use v2 aliases. Their migration to explicit v3 imports and runtime database setup is intentionally deferred to #1980.

Verification

• cargo test -p torrust-tracker-configuration
• cargo test --workspace
• linter all
• Pre-commit and pre-push hooks

Fixes #1490

[Copilot]

Pull request overview

Decomposes v3 database configuration into explicit SQLite, MySQL, and PostgreSQL variants with validation, secret handling, and migration documentation.

Changes:

• Adds driver-specific database configuration and connection details.
• Adds port defaults, password validation, and redacted persistence.
• Updates migration guidance and implementation tracking.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Summary	Review status
packages/configuration/src/v3_0_0/mod.rs	Integrates v3 persistence and configuration tests.	No final comments
packages/configuration/src/v3_0_0/database.rs	Defines database variants, validation, and serialization.	Requires changes: critical load-path default merging issue; moderate SQLite path accessibility issue
docs/issues/open/1978-configuration-overhaul-epic/configuration-v2-to-v3-migration.md	Documents database migration examples.	No final comments
docs/issues/open/1490-1978-decompose-database-configuration.md	Records implementation and verification status.	No final comments

Suppressed comments (2)

packages/configuration/src/v3_0_0/database.rs:256

• This assertion exposes the password solely for incidental test inspection. The repository's secret-handling contract requires avoiding expose_secret() in tests when the value can be checked through the redacted SecretString/containing value; mirror the MySQL test above and compare the complete PostgreSQL value instead.

        assert_eq!(connection.password.expose_secret(), "db_password");

packages/configuration/src/v3_0_0/database.rs:338

• The new security-sensitive Debug path is not covered here: this test only verifies custom JSON serialization. Existing token tests assert the exact SecretBox<str>([REDACTED]) form and absence of the unique secret; add the same assertion for format!("{database:?}") so a future field/derive change cannot reintroduce a database-password leak.

        let serialized = serde_json::to_string(&database).expect("database configuration should serialize");

        // Assert
        assert!(serialized.contains("***"));
        assert!(!serialized.contains(password));

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[josecelano]

ACK 19a2b9b