test(db-resolve): remove duplicated production password from test file

The test never connects to Postgres, it only asserts resolution
behaviour, so the real prod URL had no reason to be duplicated here.
Swapped for a dummy postgres://u:p@h:5432/db throughout.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/hq/test/db-resolve.test.ts

@@ -7,7 +7,7 @@
 import { describe, it, expect } from 'vitest'
 import { pgTargetDescription, requireDbUrlForEnv, resolveDbUrl } from '../src/db-pg'
 
-const HARDCODED = 'postgres://postgres:inv123@host.docker.internal:5432/hq'
+const HARDCODED = 'postgres://u:p@h:5432/db'
 
 describe('resolveDbUrl (D19 engine selection, the one shared resolver)', () => {
   it('DATABASE_URL wins regardless of NODE_ENV', () => {