Figment was prefixed with APP_, so APP__DATABASE__URL never mapped to database.url and the server kept logging in as the default app role. Also walk up to the workspace .env and log a redacted DSN.