Agent pool Postgres DSN is logged in cleartext, including the password, while the auth DSN is redacted

LocalAI version

v4.9.0 (localai/localai:latest-gpu-nvidia-cuda-12, revision f7ad3f70eb5d8a0ddf80e08557f0d7df28cf032e)

Describe the bug

When the agent pool uses the Postgres vector engine, LocalAI logs the full LOCALAI_AGENT_POOL_DATABASE_URL at INFO level, including the database password in cleartext, every time it opens a collection.

The auth database URL is redacted correctly in the same log stream, so the redaction helper already exists. It just is not applied on this path.

Redacted (correct), from LOCALAI_AUTH_DATABASE_URL:

INFO Auth enabled database="postgresql://%2A%2A%2A:%2A%2A%2A@postgres:5432/localai_auth?sslmode=disable"

Not redacted, from LOCALAI_AGENT_POOL_DATABASE_URL (password replaced by hand before pasting here):

INFO PostgreSQL collection collectionName="AML" databaseURL="postgresql://localai_user:REDACTED-PASSWORD@postgres:5432/localai?sslmode=disable"

One line is emitted per collection on every start, so the credential is repeated and persists in whatever collects container logs. In a Docker deployment these sit on disk under the json-file driver and are readable by anyone who can read container logs, for example through a management UI, without any access to the environment or the compose file.

To Reproduce

1. Set LOCALAI_AGENT_POOL_VECTOR_ENGINE=postgres and LOCALAI_AGENT_POOL_DATABASE_URL=postgresql://user:password@host:5432/db?sslmode=disable
2. Have at least one agent collection defined.
3. Start LocalAI and read the log.

The PostgreSQL collection line contains the password verbatim.

Expected behavior

The agent pool DSN should be redacted in logs the same way the auth DSN already is, or the log line should print only the host, port and database name rather than the whole URL.

Additional context

Not configurable from the outside: the value has to be a DSN, so there is no way for an operator to avoid this short of not using the Postgres vector engine. Rotating the password does not help, because the new one is logged too.

Suggested fix: apply the same redaction used for the auth DSN to the agent pool DSN before logging.