Fix MySQL DSN escaping for setup passwords and clarify DB user setup

internal/localdb/localdb.go

@@ -4,12 +4,15 @@ import (
 	"errors"
 	"fmt"
 	"log/slog"
+	"net"
 	"os"
 	"path/filepath"
+	"strconv"
 	"strings"
 	"time"
 
 	"git.mchus.pro/mchus/quoteforge/internal/appmeta"
+	mysqlDriver "github.com/go-sql-driver/mysql"
 	"github.com/glebarez/sqlite"
 	uuidpkg "github.com/google/uuid"
 	"gorm.io/gorm"
@@ -141,19 +144,23 @@ func (l *LocalDB) GetDSN() (string, error) {
 		return "", err
 	}
 
-	// Add aggressive timeouts for offline-first architecture
-	// timeout: connection establishment timeout (3s)
-	// readTimeout: I/O read timeout (3s)
-	// writeTimeout: I/O write timeout (3s)
-	dsn := fmt.Sprintf("%s:%s@tcp(%s:%d)/%s?charset=utf8mb4&parseTime=True&loc=Local&timeout=3s&readTimeout=3s&writeTimeout=3s",
-		settings.User,
-		settings.PasswordEncrypted, // Contains decrypted password after GetSettings
-		settings.Host,
-		settings.Port,
-		settings.Database,
-	)
+	cfg := mysqlDriver.NewConfig()
+	cfg.User = settings.User
+	cfg.Passwd = settings.PasswordEncrypted // Contains decrypted password after GetSettings
+	cfg.Net = "tcp"
+	cfg.Addr = net.JoinHostPort(settings.Host, strconv.Itoa(settings.Port))
+	cfg.DBName = settings.Database
+	cfg.ParseTime = true
+	cfg.Loc = time.Local
+	// Add aggressive timeouts for offline-first architecture.
+	cfg.Timeout = 3 * time.Second
+	cfg.ReadTimeout = 3 * time.Second
+	cfg.WriteTimeout = 3 * time.Second
+	cfg.Params = map[string]string{
+		"charset": "utf8mb4",
+	}
 
-	return dsn, nil
+	return cfg.FormatDSN(), nil
 }
 
 // DB returns the underlying gorm.DB for advanced operations