Take the database password from PGPASSWORD, not the DSN

The chart asked for a whole DSN in a Secret. Nothing writes one: the
Zalando postgres operator generates a Secret with `username` and
`password` keys and no connection string, so wiring the wrapper chart up
would have meant hand-maintaining a second copy of a password the
operator owns and rotates on a from-scratch rebuild -- which is charts#176
again, the issue miniflux closed by doing the opposite.

So the DSN becomes a plain value with no password in it, and the password
arrives as PGPASSWORD from a Secret. pgx fills in from libpq's PG*
environment variables whatever the DSN omits, exactly as miniflux's
lib/pq does. Verified rather than assumed, against a real server: a
password-less DSN connects with PGPASSWORD set, and fails with
`password authentication failed` when it is wrong, so the variable is
doing the work rather than being quietly ignored.

It also keeps the credential out of the rendered manifest and out of
`kubectl describe pod`, which a DSN-with-password does not.

Makefile

@@ -87,11 +87,12 @@ fmt: ## Report unformatted files
 		echo "gofmt needed:"; echo "$$unformatted"; gofmt -d .; exit 1; \
 	fi
 
-# database.dsnSecret.name has no default and the deployment `required`s it: the
-# chart provisions no database and cannot guess where the credentials live, so a
-# render without it is meant to fail. Setting it here keeps the lint honest about
-# what a working install needs.
-HELM_LINT_SET = --set image.tag=v0.0.0 --set database.dsnSecret.name=terdut-db
+# database.dsn has no default and the deployment `required`s it: the chart
+# provisions no database and cannot guess where it is, so a render without it is
+# meant to fail. Setting it here keeps the lint honest about what a working
+# install needs.
+HELM_LINT_SET = --set image.tag=v0.0.0 \
+	--set 'database.dsn=postgres://terdut@terdut-postgres:5432/terdut?sslmode=require'
 
 .PHONY: helm-lint
 helm-lint: ## Lint and render the chart