fix: keep credentials out of the DSN rewrite warning

The warning added earlier in this branch logged the whole Postgres DSN, password
included, and nothing else in the library has ever printed a connection string.
It now reports only the scheme segment, which is the part that actually changed.

Regression test asserts the password and host/path never reach the log.

tests/unit/test_config.py

@@ -523,11 +523,22 @@ class TestCrossFieldInvariants:
             settings = dataclasses.replace(
                 base,
                 telemetry_backend="postgres",
-                telemetry_pg_dsn="postgresql+asyncpg://u@h/db",
+                telemetry_pg_dsn="postgresql+asyncpg://u:s3cret@h/db",
             )
-        assert settings.telemetry_pg_dsn == "postgresql://u@h/db"
+        assert settings.telemetry_pg_dsn == "postgresql://u:s3cret@h/db"
         assert any("asyncpg" in m for m in warnings)
 
+    def test_dsn_warning_does_not_leak_credentials(self):
+        """DSN 带密码,日志只能出现 scheme 段(P5: 敏感信息只走 .env)。"""
+        base = self._base()
+        with _captured_warnings() as warnings:
+            dataclasses.replace(
+                base,
+                telemetry_backend="postgres",
+                telemetry_pg_dsn="postgresql+asyncpg://u:s3cret@h/db",
+            )
+        assert warnings and not any("s3cret" in m or "@h/db" in m for m in warnings)
+
     def test_env_path_strips_dsn_without_warning(self):
         """env 路已在 _load_pg_dsn 剥过,不该给三项目的历史 DSN 写法刷噪音。"""
         with _captured_warnings() as warnings: