discover: broaden discovery to feed the new drivers

Per the standing directive (dynamic discovery per credential type as each
driver lands):
- env.go: tag DB connection URLs by scheme (postgres/postgresql, mysql/mariadb,
  redis/rediss) with a user:password authority, routing DATABASE_URL/REDIS_URL/
  MYSQL_URL straight to the in-place DB drivers, kept regardless of the
  secret-name heuristic.
- aws.go: emit the driver-ready single-line blob (was the bare secret) and
  resolve region from env / ~/.aws/config.
- ssh.go: content-based key detection (not just id_*) + ~/.ssh/config
  IdentityFile parsing.
- tea.go: new scanner mapping Gitea `tea` CLI config to a driver-ready PAT blob.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/discover/env.go

@@ -4,6 +4,7 @@ import (
 	"bufio"
 	"context"
 	"math"
+	"net/url"
 	"os"
 	"path/filepath"
 	"strings"
@@ -53,12 +54,19 @@ func (e *envScanner) Scan(ctx context.Context, v *vault.Vault) ([]Credential, er
 				continue
 			}
 			val = strings.Trim(val, `"'`)
-			if !looksSecret(k, val) {
+			// A connection-string value (DATABASE_URL, REDIS_URL, …) is tagged with
+			// the rotation driver's Source so it becomes driver-ready, and is kept
+			// regardless of the secret-ish heuristic: a weak/empty DB password is
+			// exactly the kind of leak we must not miss.
+			source, kind := e.Name(), Kind(KindToken)
+			if dbSrc := dbSourceForURL(val); dbSrc != "" {
+				source, kind = dbSrc, KindPassword
+			} else if !looksSecret(k, val) {
 				continue
 			}
 			creds = append(creds, Credential{
-				Source:   e.Name(),
-				Kind:     KindToken,
+				Source:   source,
+				Kind:     kind,
 				Identity: filepath.Base(p) + " / " + k,
 				Location: p,
 				Modified: fi.ModTime(),
@@ -73,6 +81,29 @@ func (e *envScanner) Scan(ctx context.Context, v *vault.Vault) ([]Credential, er
 	return creds, nil
 }
 
+// dbSourceForURL maps a value that is a database connection URL to the rotation
+// driver Source that can rotate it ("postgres"/"mysql"/"redis"), or "" if the value
+// is not a recognised DB URL. It requires a user:password authority so a bare
+// "redis://localhost" (nothing to rotate) is not mis-tagged.
+func dbSourceForURL(val string) string {
+	u, err := url.Parse(val)
+	if err != nil || u.User == nil {
+		return ""
+	}
+	if _, hasPw := u.User.Password(); !hasPw && u.User.Username() == "" {
+		return ""
+	}
+	switch strings.ToLower(u.Scheme) {
+	case "postgres", "postgresql":
+		return "postgres"
+	case "mysql", "mariadb":
+		return "mysql"
+	case "redis", "rediss":
+		return "redis"
+	}
+	return ""
+}
+
 func looksSecret(key, val string) bool {
 	lk := strings.ToLower(key)
 	for _, h := range sensitiveHints {