fix: harden tenant auth and quality gates

api/prisma.config.ts

@@ -1,13 +1,17 @@
 import { defineConfig } from 'prisma/config';
 
+const databaseUrl = process.env.DATABASE_URL?.trim();
+const allowDevelopmentDefault = process.env.NODE_ENV === 'development' || process.env.NODE_ENV === 'test';
+if (!databaseUrl && !allowDevelopmentDefault) {
+  throw new Error('DATABASE_URL is required outside development and test environments');
+}
+
 export default defineConfig({
   schema: 'prisma/schema.prisma',
   migrations: {
     path: 'prisma/migrations',
   },
   datasource: {
-    url:
-      process.env.DATABASE_URL ??
-      'postgresql://cmpp:cmpp_password@localhost:5432/cmpp_platform?schema=public',
+    url: databaseUrl ?? 'postgresql://cmpp:cmpp_password@localhost:5432/cmpp_platform?schema=public',
   },
 });