fix(connection-form): default SSL mode to preferred for libpq and FreeTDS engines (#1298)

[datlechin]

Summary

• PostgreSQL, Redshift, CockroachDB, and SQL Server new connections now default SSL mode to Preferred instead of Disabled, matching libpq's sslmode=prefer and FreeTDS's encryption=request native defaults
• Fixes connection failures to AWS RDS, Cloud SQL, Azure, and other hosted Postgres that enforce SSL via pg_hba.conf with the "no pg_hba.conf entry for host ... no encryption" error
• Per-engine default declared in PluginMetadataSnapshot.CapabilityFlags alongside defaultPort and supportsSSL — declarative pattern, no PluginKit ABI bump

Root cause

libpq, libmariadb, and FreeTDS all default to attempting TLS first and falling back to plain. TablePro overrode every engine with sslmode=disable, breaking against any server with rds.force_ssl=1 or hostssl rules in pg_hba.conf. DataGrip, psql, and pgAdmin "just work" because they don't override the driver default.

Scope decision

• Engines flipped to .preferred: PostgreSQL, Redshift, CockroachDB (libpq), SQL Server (FreeTDS) — drivers that genuinely implement prefer semantics
• Engines kept at .disabled: MySQL, MariaDB (libmariadb bundled has only MYSQL_OPT_SSL_ENFORCE binary toggle, no MYSQL_OPT_SSL_MODE), Mongo, Redis, Cassandra, ClickHouse, Oracle (binary-on/off drivers with no prefer semantics)
• Cloud SQL / Azure MySQL needs a separate driver-side fix (implement 2-pass connect or upgrade to a libmariadb version with MYSQL_OPT_SSL_MODE)
• Existing saved connections on disk are unchanged (decode fallback stays .disabled to preserve user intent)
• Sync import falls back to per-engine default when sslConfigJson is absent

Wiring

• DatabaseType.defaultSSLMode computed property reads from PluginMetadataRegistry, same pattern as defaultPort
• SSLPaneViewModel.resetForType(_:) sets mode from registry and clears cert paths
• ConnectionFormCoordinator.applyTypeDefaults calls it on engine change (covers start(), didChangeType, and applyParsed URL import)
• ConnectionFormCoordinator.applyParsed URL import: parsed.sslMode ?? parsed.type.defaultSSLMode
• ConnectionFormCoordinator.applyClipboardCandidate: changed upgradeIfDisabled(.required) to unconditional ssl.mode = .required when clipboard URL has sslmode=require (otherwise the new .preferred default would silently swallow the user's explicit intent)
• SyncRecordMapper: fallback uses DatabaseType.defaultSSLMode when sslConfigJson is missing

Test plan

• Build and run on macOS: open New Connection → PostgreSQL → SSL pane shows Preferred (was Disabled)
• Switch engine from PostgreSQL to Redis in the form → SSL pane resets to Disabled
• Switch engine from Redis back to PostgreSQL → SSL pane resets to Preferred (cert paths cleared)
• Edit an existing PostgreSQL connection saved with SSL .disabled → SSL pane still shows Disabled (intent preserved)
• Connect to AWS RDS PostgreSQL with default settings → no pg_hba.conf error
• Connect to local Docker PostgreSQL without TLS → still works (libpq falls back to plain when prefer fails)
• Paste postgres://user:pass@host:5432/db?sslmode=require from clipboard → form picks Required, not Preferred
• Paste postgres://user:pass@host:5432/db (no sslmode) from clipboard → form picks Preferred
• Sync a connection with missing sslConfigJson field for PostgreSQL → decodes with .preferred
• Run xcodebuild test -only-testing:TableProTests/DatabaseTypeTests — all new defaultSSLMode tests pass
• Run xcodebuild test -only-testing:TableProTests/SSLPaneViewModelTests — all resetForType tests pass