scaffold compose: POSTGRES_PASSWORD is inserted unencoded into SM_DATABASE_URL #472

Follow-up to #446 (GH #444).

Problem

The scaffolded compose files build the database URL by putting the raw password into it:

SM_DATABASE_URL: "postgresql+asyncpg://postgres:${POSTGRES_PASSWORD:?...}@postgres:5432/<db>"

(templates/docker/compose-base-postgres.yml.tpl, compose-tasks-postgres.yml.tpl)

The password smpy new generates is token_urlsafe, so it is safe. But make docker-up tells users who copied .env.example to set POSTGRES_PASSWORD themselves. A password that contains @, :, /, #, ? or % produces a malformed URL. The app then fails to connect, with a confusing host or port parse error.

Options

• Document in .env.example and the docs that the password must be URL-safe, or percent-encoded in a separate variable; or
• have the app accept separate SM_DATABASE_* parts (or a password override) and assemble the URL with sqlalchemy.engine.URL.create, which escapes the password; or
• have smpy/make docker-up reject a non-URL-safe POSTGRES_PASSWORD with a clear message.