fix(ci): use DATABASE_URL env var for alembic migrations in tests

- alembic/env.py: strengthen the URL override to fall back to
  TEST_DATABASE_URL when DATABASE_URL is absent, so alembic never
  falls back to the hardcoded 'tod' URL in alembic.ini regardless
  of which env var a test runner sets.

- tests/integration/conftest.py: add explanatory comments on why
  DATABASE_URL is forced into the subprocess env, and use
  env.setdefault() to supply CREDENTIAL_ENCRYPTION_KEY if the
  calling environment omits it — migration 029 (VPN tenant
  isolation) requires it to encrypt the WireGuard server private key.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/alembic/env.py

@@ -20,9 +20,12 @@ import app.models.config_backup  # noqa: F401
 # access to the values within the .ini file in use.
 config = context.config
 
-# Override sqlalchemy.url from DATABASE_URL env var if set (for Docker)
-if os.environ.get("DATABASE_URL"):
-    config.set_main_option("sqlalchemy.url", os.environ["DATABASE_URL"])
+# Override sqlalchemy.url from environment variable so alembic never uses the
+# hardcoded URL in alembic.ini.  DATABASE_URL takes precedence; TEST_DATABASE_URL
+# is a fallback for test runners that set only that variable.
+_db_url = os.environ.get("DATABASE_URL") or os.environ.get("TEST_DATABASE_URL")
+if _db_url:
+    config.set_main_option("sqlalchemy.url", _db_url)
 
 # Interpret the config file for Python logging.
 if config.config_file_name is not None: