fix(cli): surface db connection-failure detail and fix connect suggestion classifiers

[Coly010]

What changed

Every legacy db command's connection failure previously rendered as

failed to connect to postgres: effect/sql/SqlError: PgClient: Failed to connect

— host, user, database, and the underlying driver cause were all lost, on every db push / db pull / db reset / db diff --linked / inspect / migration connection failure. The Go CLI renders pgconn's full detail:

failed to connect to postgres: failed to connect to `host=… user=… database=…`: dial error (dial tcp …: connect: connection refused)

This PR ports pgconn's connectError rendering (errors.go:66-72, wrapped by pkg/pgxv5/connect.go:33) into the legacy connection layer, and fixes the legacyConnectSuggestion classifier branches that could never fire on real node-postgres error shapes.

Message rendering (legacyConnectFailureMessage)

• toConnectError in legacy-db-connection.sql-pg.layer.ts now renders failed to connect to postgres: failed to connect to \host=… user=… database=…`: ` using the config-level identity (host/user/database — never the password), exactly like pgconn.
• The cause is unwrapped through the real SqlError → ConnectionError → driver error chain (and through AggregateError.errors[], taking the LAST attempt — pgconn's fallback loop also surfaces the last attempt's error).
• Stage labels mirror pgconn where the node error identifies the stage unambiguously: server error (SEVERITY: message (SQLSTATE code)) (byte-parity with pgconn's PgError rendering), hostname resolving error (…), dial error (…), tls error (…).

Classifier fixes (legacyConnectSuggestion)

Branch-by-branch verification against real driver shapes (captured empirically under Bun, the CLI's runtime):

Go branch	node-postgres shape	Before	After
connect: connection refused / allow_list → network-restrictions hint	ECONNREFUSED code / server text	fired	fires (unchanged, now also covered by real-SqlError tests)
SSL connection is required + --debug	server error text	fired	fires (unchanged)
SCRAM exchange: Wrong password / failed SASL auth → SUPABASE_DB_PASSWORD hint	DatabaseError 28P01 password authentication failed	fired	fires (unchanged, proven against a real wire-protocol ErrorResponse)
IPv6-only host → IPv6 pooler hint	EHOSTUNREACH/EADDRNOTAVAIL/ENETUNREACH with an IPv6 address field	dead for EHOSTUNREACH/EADDRNOTAVAIL (node puts the address in a structured field, not libpq's parenthesized literal)	fires via new structured errno+address check (legacyHasIPv6DialCause)
connect: no route to host → wrong-profile hint	connect EHOSTUNREACH <ip>:<port>	dead (node never emits "no route to host")	fires via EHOSTUNREACH, after the IPv6 branch, matching Go's branch order
Tenant or user not found → wrong-profile hint	Supavisor server error text	fired	fires (unchanged)

NODE_ENETUNREACH_PATTERN now also tolerates a closing paren after the port, since the new message format parenthesizes the driver cause.

CLI-1942 guard (no accidental divergence)

Go has no suggestion branch for the session-pooler EOF drop (unexpected EOF); node-postgres' equivalent is Connection terminated unexpectedly. Tests pin that this shape stays unclassified (generic --debug fallback) and that the message still carries the full host=… user=… identity plus the cause verbatim.

Residual driver-text differences (impossible to byte-match)

The inner cause text comes from the driver, so exact byte parity with Go is impossible where the drivers word things differently — the structure (failed to connect to postgres: prefix + host=… user=… database=… + cause) and the stage labels match:

• Dial errors: node connect ECONNREFUSED 1.2.3.4:5432 vs Go dial tcp 1.2.3.4:5432: connect: connection refused.
• Wrong password over SCRAM: pgconn labels by auth phase (failed SASL auth (…)), which node-postgres does not expose, so TS renders server error (…) — the inner FATAL: password authentication failed for user "postgres" (SQLSTATE 28P01) bytes and the fired hint are identical.
• Unrecognized causes (e.g. the CLI-1942 EOF, connect timeout) render verbatim with no stage word, where pgconn would say failed to receive message (unexpected EOF) — no stage is guessed rather than fabricating a wrong one.
• Server-side failures (server error (SEVERITY: message (SQLSTATE code))) are byte-identical to Go given the same server bytes.

Review findings deliberately left open

Five-perspective review (architect / engineer / security / DX / go-parity-auditor) all approved. Non-blocking items noted for follow-up rather than churned here:

• Consolidating the module's four error-chain traversals (collector / deepest-path / two any-match predicates) into one walk primitive — they have genuinely different semantics and predate this PR; cross-referencing doc comments were added instead.
• Pre-existing, negligible divergence: an IPv4 ENETUNREACH gets no suggestion in TS while Go's over-broad network is unreachable text match would show the IPv6 hint even for IPv4 — the TS IPv6-literal gate is deliberate and pre-existing.
• Pre-existing: password authentication failed as a wrong-password disjunct would also classify a theoretical non-SCRAM 28P01 that Go leaves unclassified; Supabase auth is always SCRAM.

Related: this PR does not touch output.layer.ts (PR #5946 / CLI-1973 territory) — the change is confined to the SqlError mapping and the classifier module.

Fixes CLI-1976

[Coly010]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Chef's kiss.

Reviewed commit:3c57c4e250

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:3c57c4e250

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

Supabase CLI preview

npx --yes https://pkg.pr.new/supabase/cli/supabase@42cbd82c6437b1ea6c44ed85525bc5b2844e39ea

Preview package for commit 42cbd82.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:e58b751013

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Coly010]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Can't wait for the next one!

Reviewed commit:42cbd82c64

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".