fix(server): avoid plaintext fallback for Postgres SQL errors

[tahodev]

What

Stop sslmode=prefer from retrying over plaintext when PostgreSQL has already returned a five-character SQLSTATE error. Add a regression test that verifies only the TLS attempt runs for a syntax error.

Why

A PostgreSQL SQLSTATE means the server received the connection and rejected the query. Changing transport cannot fix that failure. The old fallback sent the credentials and query again over plaintext, and could turn an error into a success if circumstances changed between attempts. TLS handshake and transport failures retain their existing fallback behavior.

Validation

• bunx vitest run packages/server/src/services/data-source-query/execute-query.test.ts (17 passed)
• bunx turbo typecheck --filter=@onequery/server --json (passed)
• bunx oxfmt on changed files and git diff --check (passed)

Local oxlint panicked in its Rust allocator; CI should verify lint.