- alembic/env.py: strengthen the URL override to fall back to
TEST_DATABASE_URL when DATABASE_URL is absent, so alembic never
falls back to the hardcoded 'tod' URL in alembic.ini regardless
of which env var a test runner sets.
- tests/integration/conftest.py: add explanatory comments on why
DATABASE_URL is forced into the subprocess env, and use
env.setdefault() to supply CREDENTIAL_ENCRYPTION_KEY if the
calling environment omits it — migration 029 (VPN tenant
isolation) requires it to encrypt the WireGuard server private key.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
