fix(whatsapp): keep pooler hostname for SNI, dial via hostaddr IPv4

whatsapp-service/pkg/config/config.go

@@ -125,11 +125,13 @@ func withConnectTimeout(dsn string, seconds int) string {
 	return dsn
 }
 
-// forceIPv4DSN rewrites the DSN host to its resolved IPv4 address. Container
-// runtimes (HF Spaces, many CI/cloud networks) frequently have no IPv6 route;
-// a hostname whose DNS returns only an AAAA record first then fails to connect
-// ("network is unreachable"). lib/pq dials whatever family the URL names, so
-// pin the address to IPv4 to keep the connection working on IPv6-less hosts.
+// forceIPv4DSN keeps the DSN hostname (required for TLS SNI / pooler routing)
+// but adds a hostaddr=<IPv4> parameter so lib/pq dials the resolved IPv4
+// address instead. Container runtimes (HF Spaces, many CI/cloud networks)
+// frequently have no IPv6 route; a hostname whose DNS returns only an AAAA
+// record first then fails to connect ("network is unreachable"). Never replace
+// the hostname with an IP — Supavisor (Supabase pooler) routes tenants by SNI,
+// and lib/pq uses `host` for TLS server-name verification.
 func forceIPv4DSN(dsn string) string {
 	if dsn == "" {
 		return dsn
@@ -142,7 +144,6 @@ func forceIPv4DSN(dsn string) string {
 	if host == "" || net.ParseIP(host) != nil {
 		return dsn
 	}
-	port := u.Port()
 	ips, err := net.LookupIP(host)
 	if err != nil {
 		return dsn
@@ -157,11 +158,9 @@ func forceIPv4DSN(dsn string) string {
 	if v4 == "" {
 		return dsn
 	}
-	if port != "" {
-		u.Host = net.JoinHostPort(v4, port)
-	} else {
-		u.Host = v4
-	}
+	q := u.Query()
+	q.Set("hostaddr", v4)
+	u.RawQuery = q.Encode()
 	return u.String()
 }