fix(tests): stop DATABASE_URL env race flaking sqlx lib tests

The private_mode_* config unit tests set then remove_var(DATABASE_URL).
That env is process-global, and the #[sqlx::test] lib tests
(crawler::content, crawler::session_control, ...) read it in parallel,
so on a multi-core runner they intermittently saw it unset and panicked
'DATABASE_URL must be set: NotPresent' (6 failures on the Pi's 4 cores).
Never overwrite/remove it: set only if absent via ensure_database_url(),
leaving CI's real URL stable for the parallel DB tests.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/config.rs

@@ -630,6 +630,18 @@ mod tests {
     // (we set/unset within each guard region).
     static ENV_GUARD: Mutex<()> = Mutex::new(());
 
+    /// Ensure `DATABASE_URL` is set for `Config::from_env()` WITHOUT clobbering
+    /// or removing an existing value. The `#[sqlx::test]` lib tests in other
+    /// modules read `DATABASE_URL` from the same process env and run in
+    /// parallel with these `ENV_GUARD`-serialised tests; overwriting it (bad
+    /// host) or removing it ("NotPresent") flaked them. CI already exports the
+    /// real URL, so this is a no-op there; locally it provides a placeholder.
+    fn ensure_database_url() {
+        if std::env::var_os("DATABASE_URL").is_none() {
+            std::env::set_var("DATABASE_URL", "postgres://test");
+        }
+    }
+
     #[test]
     fn crawler_limit_env_populates_manga_limit() {
         let _g = ENV_GUARD.lock().unwrap_or_else(|p| p.into_inner());
@@ -757,10 +769,13 @@ mod tests {
     fn private_mode_env_parses_true() {
         let _g = ENV_GUARD.lock().unwrap_or_else(|p| p.into_inner());
         std::env::set_var("PRIVATE_MODE", "true");
-        std::env::set_var("DATABASE_URL", "postgres://test");
+        // Don't clobber/unset DATABASE_URL: parallel #[sqlx::test] lib tests
+        // read it from the process env and would flake ("NotPresent") on the
+        // removal. Ensure it's present (CI sets it) without overwriting a real
+        // one, and never remove it.
+        ensure_database_url();
         let cfg = Config::from_env().expect("from_env");
         std::env::remove_var("PRIVATE_MODE");
-        std::env::remove_var("DATABASE_URL");
         assert!(cfg.auth.private_mode);
     }
 
@@ -768,10 +783,9 @@ mod tests {
     fn private_mode_env_parses_false() {
         let _g = ENV_GUARD.lock().unwrap_or_else(|p| p.into_inner());
         std::env::set_var("PRIVATE_MODE", "false");
-        std::env::set_var("DATABASE_URL", "postgres://test");
+        ensure_database_url();
         let cfg = Config::from_env().expect("from_env");
         std::env::remove_var("PRIVATE_MODE");
-        std::env::remove_var("DATABASE_URL");
         assert!(!cfg.auth.private_mode);
     }
 
@@ -779,9 +793,8 @@ mod tests {
     fn private_mode_defaults_to_false() {
         let _g = ENV_GUARD.lock().unwrap_or_else(|p| p.into_inner());
         std::env::remove_var("PRIVATE_MODE");
-        std::env::set_var("DATABASE_URL", "postgres://test");
+        ensure_database_url();
         let cfg = Config::from_env().expect("from_env");
-        std::env::remove_var("DATABASE_URL");
         assert!(!cfg.auth.private_mode);
     }
 }