fix(security): remove internal infra identifiers from published package

[andrei-hasna]

Summary

This package leaked more than the reported RDS cluster name — the full finding set:

1. Live runtime leak (high severity): getCanonicalConversationsRdsConfig() in src/lib/storage-sync.ts hardcoded the real production RDS cluster name (hasna-xyz-infra-apps-prod-postgres) and Secrets Manager runtime-secret path (hasna/xyz/opensource/conversations/prod/rds) as literal exported constants, consumed by both the CLI (conversations storage status) and the MCP tool (conversations_storage_status) — meaning any installer of this public npm package who ran storage status got these real identifiers printed back to them. Fixed by sourcing both from new environment variables (HASNA_CONVERSATIONS_RDS_CLUSTER, HASNA_CONVERSATIONS_RDS_SECRET_PATH) with no OSS-baked default; output now shows (not configured — set <ENV>) when unset.
2. Removed a sensitive internal ops runbook that should never have been public: docs/CUTOVER-RUNBOOK.md contained the real AWS account ID (789877399345), the full RDS endpoint DNS hostname (hasna-xyz-infra-apps-prod-postgres.culaqeaao9n7.us-east-1.rds.amazonaws.com), a real bastion EC2 instance ID, Secrets Manager paths, and an internal Slack channel name. This is beyond "move to env" — it's operational documentation that has no place in a public repo. Deleted from the package; the internal cutover procedure now lives in Hasna's internal ops docs (not shipped here).
3. README.md — replaced the hasna/xyz/opensource/conversations/prod/rds / hasna-xyz-infra-apps-prod-postgres references with generic env-var instructions.
4. src/lib/cloud-store.ts (+ its test) — internal hostname conversations.hasna.xyz in a doc comment / test fixtures → conversations.md.
5. Updated tests to assert the env-driven mechanism with placeholder values (example-cluster, example/secret/path) instead of asserting the real production identifiers, and added explicit env isolation so tests are deterministic regardless of what's set on a real deployment host.

Important — residual leak NOT fixable from this repo

Same as the sibling hasna/knowledge fix: the self-hosted client-flip default host (resolveConversationsCloud → resolveStorageClient()) delegates to @hasna/contracts's defaultCloudBaseUrl(name), which hardcodes `https://${name}.hasna.xyz`. There is no supported override for this from the consuming package. @hasna/contracts needs its own follow-up fix before this class of leak is fully closed for every Hasna OSS package that uses the client-flip helper.

Scrubbed identifier classes

• Internal API hostname: conversations.hasna.xyz → conversations.md
• Internal RDS cluster name: hasna-xyz-infra-apps-prod-postgres → operator env var, no default
• Secrets Manager runtime path: hasna/xyz/opensource/conversations/prod/rds → operator env var, no default
• AWS account ID, RDS endpoint DNS hostname, bastion instance ID, internal Slack channel name (docs/CUTOVER-RUNBOOK.md) → removed entirely from the public package

Needs patched republish after merge

Yes — the live CLI/MCP storage status surfaces and the README currently ship the real identifiers to every installer of the current published version. A patch version bump + npm publish is required after merge.

Test plan

• bun install && bun run build && bun run typecheck all succeed
• bun test — 1012 pass / 2 fail (1014 total incl. 2 new tests) — fail count and specific failing tests are identical to a pristine main checkout (pre-existing ambient-env-dependent failures: a stray local DATABASE_URL and an intentional error-log test), unrelated to this change
• Manual grep sweep for hasna.xyz, hasna-xyz-infra, hasna/xyz/, the AWS account ID, RDS hostname, and bastion instance ID across tracked files post-fix — all clear except the unrelated @hasna/contracts dependency noted above