Tighten the DB_URI shape refusal: a fragment's query, false doc sentences, and the echoed near-miss #1126

Found by a scoped security read of the DB_URI shape refusal added to #1125. None of it blocks that PR; all of it is in the refusal or in the redaction around it.

What

1. The new fallback reads a ? inside a fragment as a query. postgres://#?host=/sock is now accepted and dials localhost, where before the gate it was refused. The scan should end the authority at the first /, ? or # and ignore anything after a # when looking for a host/hostaddr query key.
2. Two doc sentences in the refusal are false. "a refused string is one with no ://" is untrue for postgres://, postgres://// and postgres:///db, which have :// and are refused; and "everything sqlx can dial is left alone" is untrue for the same three, which sqlx parses to localhost. The doc should state the deliberate divergence and the three cases.
3. Base behaviour, unchanged by feat(cli): migrate a Postgres relay into LMDB, with resume, verify and a reported throughput #1125: a string containing :// outside a valid scheme (password=ab://cd, alice:s3cret@host://db) passes the gate and is echoed whole in could not read the source at. Either such a string should be refused, or the echo should print nothing of the value.
4. Minor, from the same read: postgres://user@:5432/db is newly accepted (sqlx: empty host, no dial), %68ost as a query key is refused, and the socket-form test asserts less than the hostaddr one.

Acceptance

• A test per shape in 1 and 3, each failing without the change.
• The doc comment matches the predicate, including the deliberate strictness and its reason.
• The socket and hostaddr forms still dial (they are what a Unix-socket relay uses).

Related: #1125, #1115.