fix(api-server): default DB secret paths to in-pod mount location

[bsquizz]

Summary

• seed-admin and encrypt-credentials subcommands inherit upstream rh-trex-ai defaults (secrets/db.host) which don't match the API server pod's volume mount at /secrets/db/db.host, requiring every caller to pass explicit --db-*-file flags
• Extract a shared setInPodDBDefaults helper that overrides the defaults to /secrets/db/db.*
• Remove the now-redundant --db-*-file flags from the bootstrap-admin Job manifest

Spec impact

None — no specs reference seed-admin, the bootstrap job, or DB secret paths.

Test plan

• kubectl exec into API server pod and run seed-admin --username test without --db-*-file flags — should connect to DB successfully
• Verify bootstrap-admin Job still works on fresh deployment (no explicit DB path flags needed)
• go build ./... passes in components/ambient-api-server/

🤖 Generated with Claude Code

[YiqinZhang]

🤖 Amber Review

Fixes incorrect DB secret file paths: upstream rh-trex-ai defaults to secrets/db.host (no leading slash), but in-pod mounts are at /secrets/db/db.host. Extracts setInPodDBDefaults() helper called in both seed_admin.go and encrypt_credentials.go, removes redundant --db-*-file flags from the bootstrap Job manifest.

Findings:

• Minor: No unit test for setInPodDBDefaults — the function is trivial (five string assignments) and a table-driven test would prevent future regressions cheaply.

Correct, DRY improvement. No security surface touched, no tokens involved. Logic is trivially verifiable by inspection.

Confidence: High

---

— Amber, ACP codebase intelligence