feat(12-06): expose non-secret DB name via GET /api/setup/status (gap 3)

- status returns { setupComplete, dbName } from process.env.DB_NAME (null fallback)
- only the DB name; never DB_HOST/DB_USER/DB_PASSWORD
- SetupStatusResponse carries dbName?: string | null for the PWA read-only field

apps/api/src/routes/setup.ts

@@ -88,7 +88,10 @@ setupRouter.get('/status', async (c) => {
   // completion (D-10). Using it here keeps the status response in sync with the guard
   // without a second DB read pattern (covers setup_complete AND effective-config).
   const locked = await isSetupLocked();
-  return c.json({ setupComplete: locked });
+  // Gap 3 (backend): surface the NON-SECRET DB name so the PWA can render a read-only
+  // field giving the "database connection verified" row an on-screen referent. Only the
+  // database NAME is exposed — never DB_HOST/DB_USER/DB_PASSWORD (connection secrets/topology).
+  return c.json({ setupComplete: locked, dbName: process.env.DB_NAME ?? null });
 });
 
 // ---------------------------------------------------------------------------