security: remove credential SQL comments and add DATABASE_URL fail-fast check

- Remove hardcoded SQL comments containing 'ml_user' and 'ml_password'
- Remove fallback default credentials in DATABASE_URL construction
- Add fail-fast validation: raise RuntimeError if DATABASE_URL env var is missing or empty
- Mark task 1.4 as complete in code-review-fix/tasks.md

openspec/changes/code-review-fix/tasks.md

@@ -3,7 +3,7 @@
 - [x] 1.1 `[haiku]` Add `.env` to `.gitignore` and run `git rm --cached .env` to untrack it
 - [x] 1.2 `[haiku]` Add `models/` and `*.pkl` to `.gitignore`
 - [x] 1.3 `[haiku]` Replace real credentials in `.env.example` with placeholders (`POSTGRES_PASSWORD=change_me_to_a_strong_password`)
-- [ ] 1.4 `[haiku]` Remove SQL comment with credentials from `services/ml/app/db.py` and add fail-fast check for missing `DATABASE_URL`
+- [x] 1.4 `[haiku]` Remove SQL comment with credentials from `services/ml/app/db.py` and add fail-fast check for missing `DATABASE_URL`
 - [ ] 1.5 `[sonnet]` Update `docker-compose.yml` to use `${POSTGRES_USER}`, `${POSTGRES_PASSWORD}`, `${POSTGRES_DB}` env var interpolation in all DATABASE_URL values
 - [ ] 1.6 `[haiku]` Bind PostgreSQL port to `127.0.0.1:5432:5432` in `docker-compose.yml`
 - [ ] 1.7 `[haiku]` Bind MLflow port to `127.0.0.1:5000:5000` in `docker-compose.yml`

services/ml/app/db.py

@@ -15,20 +15,13 @@ from sqlalchemy.orm import sessionmaker, Session
 from sqlalchemy.sql import func
 
 
-# CREATE DATABASE ml_service;
-# CREATE USER ml_user WITH ENCRYPTED PASSWORD 'ml_password';
-# GRANT ALL PRIVILEGES ON DATABASE ml_service TO ml_user;
-
-
 # Database connection configuration from environment
-DATABASE_URL = os.getenv(
-    "DATABASE_URL",
-    f"postgresql://{os.getenv('POSTGRES_USER', 'ml_user')}:"
-    f"{os.getenv('POSTGRES_PASSWORD', 'ml_password')}@"
-    f"{os.getenv('POSTGRES_HOST', 'localhost')}:"
-    f"{os.getenv('POSTGRES_PORT', '5432')}/"
-    f"{os.getenv('POSTGRES_DB', 'ml_service')}"
-)
+DATABASE_URL = os.getenv("DATABASE_URL")
+if not DATABASE_URL:
+    raise RuntimeError(
+        "DATABASE_URL environment variable is required. "
+        "Please set it to a valid PostgreSQL connection string."
+    )
 
 # Create SQLAlchemy engine
 engine = create_engine(