fix: sslmode=prefer warning for non-loopback hosts, prefix nav globals

- Warn at startup when database URL uses sslmode=prefer with a
  non-loopback host (localhost/127.0.0.1/::1 are excluded)
- Prefix inline script globals in Nav.astro (_mantleNavRetries,
  _mantleDeferInitNav) to avoid collisions

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: michaelmcnees

internal/config/config.go

@@ -5,6 +5,8 @@ import (
 	"crypto/rand"
 	"encoding/hex"
 	"fmt"
+	"log"
+	"net/url"
 	"os"
 	"time"
 
@@ -231,6 +233,19 @@ func Load(cmd *cobra.Command) (*Config, error) {
 		return nil, err
 	}
 
+	// Warn if database URL uses sslmode=prefer on a non-loopback host.
+	if dbURL := cfg.Database.URL; dbURL != "" {
+		if parsed, err := url.Parse(dbURL); err == nil {
+			host := parsed.Hostname()
+			if host != "localhost" && host != "127.0.0.1" && host != "::1" {
+				q := parsed.Query()
+				if q.Get("sslmode") == "prefer" {
+					log.Printf("WARNING: database URL uses sslmode=prefer for non-loopback host %q; consider sslmode=require for production", host)
+				}
+			}
+		}
+	}
+
 	// Generate default NodeID if not set.
 	// Format: hostname:pid:random8chars — the random suffix ensures uniqueness
 	// across Kubernetes container restarts where PID 1 is common.

site/src/components/Nav.astro

@@ -102,21 +102,21 @@ function initNav() {
 }
 // Defer init until sidebar DOM exists (Nav renders before DocsSidebar).
 // Bail after a few frames if sidebar never appears (non-docs pages).
-var _navRetries = 0;
-var _navMaxRetries = 10;
-function deferInitNav() {
+var _mantleNavRetries = 0;
+var _mantleNavMaxRetries = 10;
+function _mantleDeferInitNav() {
   if (document.getElementById('docs-sidebar-mobile')) {
     initNav();
-  } else if (_navRetries < _navMaxRetries) {
-    _navRetries++;
-    requestAnimationFrame(deferInitNav);
+  } else if (_mantleNavRetries < _mantleNavMaxRetries) {
+    _mantleNavRetries++;
+    requestAnimationFrame(_mantleDeferInitNav);
   }
   // else: sidebar doesn't exist on this page — stop trying
 }
-_navRetries = 0;
-deferInitNav();
+_mantleNavRetries = 0;
+_mantleDeferInitNav();
 document.addEventListener('astro:after-swap', function() {
-  _navRetries = 0;
-  deferInitNav();
+  _mantleNavRetries = 0;
+  _mantleDeferInitNav();
 });
 </script>