fix: support explicit PostgreSQL CA bundles without plaintext fallback

src/main.rs

@@ -32,6 +32,18 @@ Expansion never runs shell commands. Quote CLI paths to let dbdash expand them.
 PostgreSQL URLs and libpq-style key=value strings are accepted.
 Use sslmode=require for mandatory TLS; certificates and hostnames are verified.
 Use sslmode=disable only for trusted local connections.
+
+For private CAs (including Amazon RDS), set PGSSLROOTCERT to a PEM CA bundle:
+  PGSSLROOTCERT="$HOME/.config/dbdash/rds-us-east-1.pem" cargo run
+This applies to saved and CLI PostgreSQL connections. Choose Require TLS in the
+connection window, or sslmode=require on the CLI; Prefer/Disable are rejected.
+Only the supplied bundle is trusted while set; macOS/system trust is unchanged.
+Certificates and hostnames are verified before authentication; no plaintext fallback.
+Missing, empty, or invalid CA files block the connection. Use a bundle obtained
+from the trusted issuer, not the certificate presented by an unverified server.
+For RDS us-east-1, download AWS's official regional bundle:
+  https://truststore.pki.rds.amazonaws.com/us-east-1/us-east-1-bundle.pem
+Enter passwords in the in-app field; putting them in CLI arguments exposes them.
 The inspector needs 70×17 terminal cells; PostgreSQL/SQLite windows need 74×25/74×21.
 
 Navigation: