[datlechin]

Summary

• A new connection starts on the TLS mode the engine's own client starts on, decided once in the core and read by Linux and Windows (core ADR 0014): Prefer for PostgreSQL and MySQL, Verify full for SQL Server, Disable for MongoDB, Redis, Cassandra and ClickHouse, Verify full with a MongoDB seed list or on ClickHouse's HTTPS ports.
• Core: TlsMode::Prefer (tokio-postgres SslMode::Prefer, sqlx Preferred, certificate not checked), TlsCapabilities::default_mode and tls_ports, DriverCapabilities::new_connection_tls.
• Every TLS failure a mode change fixes offers Change Encryption: ServerRefusedTls now does on Linux and Windows.
• Under Disable, Redis, MongoDB, Cassandra and ClickHouse check a plain login the server dropped with a TLS handshake of their own, sent with no credential, and report ServerRequiresTls when it completes.
• Linux: the Encryption row follows the default until the user picks a mode (driver switch, seed list, port), with a Prefer subtitle that says the certificate is not checked and the connection may be plain. Import preview names a file looser than a new connection.
• Windows: Prefer ("Preferred, any certificate"), the core's default per engine, the same follow rule, and remedies for an unknown issuer and a name mismatch as well as a mode the server refuses. The server name row shows only where the engine can check another name (MySQL only through SSH), from the core's ServerNameOverride.
• Foreign import keeps Preferred as Prefer; connection URLs read prefer, allow, PREFERRED, mongodb+srv:// and the trust-any-certificate flags.
• Docs: ADR 0014, core Trust, Linux roadmap criterion 6, error handling and the driver pages.
• macOS is unchanged: it keeps its own defaults until its connection form moves onto the core, and starts SQL Server on Preferred where the rule says Verify full (ADR 0014, Consequences).

Screenshots

A new PostgreSQL connection's Security group on Linux, before and after.

	Light	Dark
Before
After

Windows, from the UI tests on Arm64 (main's last run before, this PR's after): a new MySQL connection, then a new SQL Server connection.

	Light	Dark
MySQL before
MySQL after
SQL Server before
SQL Server after

Test plan

• Fails on main, passes here: ffi a_new_connection_starts_on_the_mode_the_engines_own_client_starts_on, core a_new_connection_starts_on_the_engines_default_and_a_seed_list_or_tls_port_on_verify_full, Linux tls_remedy a_server_without_tls_offers_the_encryption_row, the Linux form and dialog follow tests, Windows ConnectionDraftTests and TlsRemedyTests.
• Docker integration tests added: PostgreSQL and MySQL/MariaDB Prefer against servers with and without TLS, and Redis Require against a plain server.
• Updated on purpose: Linux verify_full_is_default (now per engine), encryption_combo_lists_only_capability_modes and the submit test's mode, the foreign-import Preferred cases, the Redis, MongoDB, Cassandra and ClickHouse plaintext_rejection_category, the PostgreSQL and MySQL capability tests, and the Windows draft fixtures.