Accept a brokered libpq environment as connection information

AUDIT-WP-0005-T02. The rapp-postgres credential playbook has the
railiance-platform broker inject PGUSER/PGPASSWORD/PGHOST/PGPORT/PGDATABASE
into the child process. audit-core only accepted AUDIT_CORE_DATABASE_URL, so
consuming a brokered lease would have meant assembling a DSN by hand from the
injected variables - putting the credential back into audit-core's own
configuration, which is what the lane exists to avoid.

An empty conninfo lets libpq read those variables directly, so a brokered lease
now needs no DSN at all. AUDIT_CORE_DATABASE_URL still works for local and test
use. Missing both is a clear startup error naming each option.

Tests 80 -> 82.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/test_backend_conformance.py

@@ -276,3 +276,43 @@ def test_migrations_are_idempotent_and_recorded():
         with backend.pool.connection() as conn:
             conn.execute(f'DROP SCHEMA IF EXISTS "{schema}" CASCADE')
         backend.close()
+
+
+@pg_only
+def test_connects_from_a_brokered_libpq_environment(monkeypatch):
+    """The credential broker injects PG* vars into the child process rather
+    than handing over a DSN, so an empty conninfo must work.
+
+    This keeps the credential out of audit-core's configuration entirely.
+    """
+    import urllib.parse
+
+    from audit_core.postgres_backend import PostgresAuditBackend
+
+    parsed = urllib.parse.urlparse(PG_URL)
+    monkeypatch.setenv("PGHOST", parsed.hostname or "127.0.0.1")
+    monkeypatch.setenv("PGPORT", str(parsed.port or 5432))
+    monkeypatch.setenv("PGUSER", parsed.username or "postgres")
+    monkeypatch.setenv("PGPASSWORD", parsed.password or "")
+    monkeypatch.setenv("PGDATABASE", (parsed.path or "/postgres").lstrip("/"))
+    monkeypatch.delenv("AUDIT_CORE_DATABASE_URL", raising=False)
+
+    schema = f"conf_{uuid.uuid4().hex[:12]}"
+    backend = PostgresAuditBackend(schema=schema)
+    try:
+        event = make_event("brokered-1")
+        assert backend.accept(event, digest(event)).duplicate is False
+        assert backend.get("brokered-1")["event_id"] == "brokered-1"
+    finally:
+        with backend.pool.connection() as conn:
+            conn.execute(f'DROP SCHEMA IF EXISTS "{schema}" CASCADE')
+        backend.close()
+
+
+def test_missing_connection_information_is_a_clear_error(monkeypatch):
+    for var in ("AUDIT_CORE_DATABASE_URL", "PGHOST", "PGUSER"):
+        monkeypatch.delenv(var, raising=False)
+    from audit_core.postgres_backend import PostgresAuditBackend
+
+    with pytest.raises(ValueError, match="no connection information"):
+        PostgresAuditBackend()