fix(notify): quote libpq connection parameters

The discrete PostgreSQL connection path concatenated raw values into a libpq keyword/value string. Whitespace, quotes, or backslashes could split a value into additional parameters or make an otherwise valid configuration fail to parse; the path also used the unsupported keyword username instead of user.

Render every generated value as a single-quoted libpq parameter, escape quotes and backslashes, and use the correct user key. Keep the existing connection_string form untouched. The earlier attempt to register migrated PostgreSQL and MySQL fields is deliberately absent because those key names collide with the legacy connection-string tokenizer.

Focused tests cover ordinary values, whitespace, quotes, backslashes, and parameter-shaped input.

Co-authored-by: ChatGPT <noreply@openai.com>
Co-authored-by: Claude <noreply@anthropic.com>

internal/event/target/postgresql_test.go

@@ -50,3 +50,25 @@ func TestPsqlTableNameValidation(t *testing.T) {
 		}
 	}
 }
+
+func TestQuoteConnParam(t *testing.T) {
+	testCases := []struct {
+		value    string
+		expected string
+	}{
+		{"localhost", "'localhost'"},
+		{"5432", "'5432'"},
+		// The reason this function exists: parameters are whitespace
+		// separated, so an unquoted space starts a new keyword.
+		{"pass word", "'pass word'"},
+		{"it's", `'it\'s'`},
+		{`back\slash`, `'back\\slash'`},
+		{`'; host=evil.example.com; x='`, `'\'; host=evil.example.com; x=\''`},
+		{"", "''"},
+	}
+	for _, testCase := range testCases {
+		if got := quoteConnParam(testCase.value); got != testCase.expected {
+			t.Errorf("quoteConnParam(%q) = %s, expected %s", testCase.value, got, testCase.expected)
+		}
+	}
+}