Raise RuntimeError on startup if POSTGRES_PASSWORD env var is not set,
instead of silently falling back to a known password in source code.
Closes #C2 from postgres migration review.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>