Redact devserver database credentials

tests/test_devserver.py

@@ -7,8 +7,22 @@ import tempfile
 import unittest
 from pathlib import Path
 
+from govoplan_core.devserver import redacted_database_url
+
 
 class DevserverSmokeTests(unittest.TestCase):
+    def test_database_url_redaction_hides_passwords(self) -> None:
+        rendered = redacted_database_url(
+            "postgresql+psycopg://govoplan:database-secret@db.example.test/govoplan"
+        )
+
+        self.assertEqual(
+            rendered,
+            "postgresql+psycopg://govoplan:***@db.example.test/govoplan",
+        )
+        self.assertNotIn("database-secret", rendered)
+        self.assertEqual(redacted_database_url("://database-secret"), "<redacted>")
+
     def test_smoke_mode_bootstraps_missing_local_sqlite_database(self) -> None:
         repo_root = Path(__file__).resolve().parents[1]
         src_root = repo_root / "src"