docs(readme): document libpq env vars for --postgres connections

[keith-oak]

introspect_postgres() passes its DSN straight to psycopg.connect() (pg_introspect.py:22), so any connection field the DSN omits falls back to the standard libpq environment variables — PGPASSWORD, PGSSLMODE, PGSSLROOTCERT, ~/.pgpass, and the rest.

That is already how you make a password-free --postgres connection, and it is what makes token-based auth work on managed PostgreSQL — on Azure Database for PostgreSQL Flexible Server, for instance, Entra ID auth works by putting a short-lived access token in PGPASSWORD:

export PGPASSWORD=$(az account get-access-token \
  --resource https://ossrdbms-aad.database.windows.net --query accessToken -o tsv)
graphify extract --postgres "postgresql://me@my-server.postgres.database.azure.com/mydb?sslmode=require"

None of that is documented — the only --postgres example in the README embeds a plaintext password in the DSN, which also puts the credential in shell history and ps output.

Docs only, no code change. Adds the PG* row to the environment-variable table and a password-free --postgres example alongside the existing one.

[graphify-labs]

Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).

Graphify reviewed this change.

Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).

---

Graphify review — findings

This PR updates the README documentation for the graphify tool. It adds a new row to the environment variables table documenting standard libpq/PG* connection variables (like PGPASSWORD, PGSSLMODE) used with the --postgres flag, and adds a new example command showing password-free PostgreSQL extraction that relies on those libpq env vars. The changes are documentation-only, touching the README's environment variables and command reference sections.

No blocking issues surfaced.

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 25 functions depend on the 25 functions this change touches.

Health — grade A; no new coupling hotspots.

Verification — 25 functions in the blast radius were not formally verified this run (proofs are advisory here).

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

• verification_scope: 25 function(s) in the blast radius were not formally verified this run