Remove stale AP database env helpers

[Che-Zhu]

What changed

• remove stale automatic database helper environment variables when an AP database reference is deleted
• preserve unrelated valueFrom environment variables
• add a regression test covering removal of DATABASE_URL and its compiled database secret helpers

Why

Deleting DATABASE_URL from an AP's Environment list removed the raw reference but preserved the automatically compiled POSTGRES_* helper variables. Those stale helpers kept the AP-to-database canvas connection visible.

The patch derives the automatic helper names from the previous raw source and excludes only those names from the existing valueFrom preservation path.

Impact

Deleting an AP database reference now removes the generated helper variables, allowing the corresponding AP-to-database connection to disappear while leaving unrelated secret-backed environment variables intact.

Validation

• bun typecheck
• bun check
• targeted regression test: AP settings draft removes unused compiled DB helpers with a deleted reference

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 97115b0259

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Drop helpers from token-expanded envRawSource

When an AP was previously saved through the structured env-token path, the stored envRawSource contains Kubernetes expansion syntax such as DATABASE_URL=postgres://$(PGPASSWORD)@db/app while the generated PGPASSWORD secret helper remains in spec.input.env. Recompiling that old raw source here only recognizes the newer ${{db.variable}} reference syntax, so the drop set is empty; deleting the DATABASE_URL row still preserves PGPASSWORD via the omitted valueFrom path, leaving the stale AP-to-DB connection visible for existing token-based APs.

Useful? React with 👍 / 👎.