fix: keep credentials out of the DSN rewrite warning

The warning added earlier in this branch logged the whole Postgres DSN, password
included, and nothing else in the library has ever printed a connection string.
It now reports only the scheme segment, which is the part that actually changed.

Regression test asserts the password and host/path never reach the log.

src/polygateway/config.py

@@ -191,8 +191,11 @@ class GatewaySettings:
             raise ValueError("telemetry_backend=postgres 时必须提供 telemetry_pg_dsn")
         stripped = _strip_dsn_driver(self.telemetry_pg_dsn)
         if stripped != self.telemetry_pg_dsn:
+            # 只报 scheme 段: DSN 带密码,整串不得进日志(P5 敏感信息只走 .env)
             logger.warning(
-                "telemetry_pg_dsn 含 SQLAlchemy 驱动后缀(asyncpg 不认),已剥为 {}", stripped
+                "telemetry_pg_dsn 的 scheme 含 asyncpg 不认的驱动后缀,已由 {} 剥为 {}",
+                self.telemetry_pg_dsn.partition("://")[0],
+                stripped.partition("://")[0],
             )
             object.__setattr__(self, "telemetry_pg_dsn", stripped)
 

tests/unit/test_config.py

@@ -523,11 +523,22 @@ class TestCrossFieldInvariants:
             settings = dataclasses.replace(
                 base,
                 telemetry_backend="postgres",
-                telemetry_pg_dsn="postgresql+asyncpg://u@h/db",
+                telemetry_pg_dsn="postgresql+asyncpg://u:s3cret@h/db",
             )
-        assert settings.telemetry_pg_dsn == "postgresql://u@h/db"
+        assert settings.telemetry_pg_dsn == "postgresql://u:s3cret@h/db"
         assert any("asyncpg" in m for m in warnings)
 
+    def test_dsn_warning_does_not_leak_credentials(self):
+        """DSN 带密码,日志只能出现 scheme 段(P5: 敏感信息只走 .env)。"""
+        base = self._base()
+        with _captured_warnings() as warnings:
+            dataclasses.replace(
+                base,
+                telemetry_backend="postgres",
+                telemetry_pg_dsn="postgresql+asyncpg://u:s3cret@h/db",
+            )
+        assert warnings and not any("s3cret" in m or "@h/db" in m for m in warnings)
+
     def test_env_path_strips_dsn_without_warning(self):
         """env 路已在 _load_pg_dsn 剥过,不该给三项目的历史 DSN 写法刷噪音。"""
         with _captured_warnings() as warnings: