Pin the newline and storage-selection rules StrykerJS found undefended

StrykerJS on the reader and its call sites left two findings about the
tests. Every trim fixture had its newline only at the end, so stripping the
first newline anywhere survived: a two-line value now pins "one trailing
newline". No fixture reached the memory branch of storage selection, so
forcing postgres, dropping the backend check or inverting it survived: the
memory default and an explicit backend of either kind are now pinned.

Idunn secret-files cut, Cut 1.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/config-secrets.test.ts

@@ -45,6 +45,7 @@ describe("readSecretInput", () => {
       ["from-the-file\n", "from-the-file"],
       ["from-the-file\r\n", "from-the-file"],
       ["two-newlines\n\n", "two-newlines\n"],
+      ["line-one\nline-two\n", "line-one\nline-two"],
       ["  inner spaces kept  \n", "  inner spaces kept  "],
       ["no-newline", "no-newline"],
     ];
@@ -147,6 +148,12 @@ describe("loadConfig secret inputs", () => {
     expect(config.storage.backend).toBe("postgres");
   });
 
+  it("keeps memory storage when no database URL is bound, and postgres when it is asked for", () => {
+    expect(loadConfig({}, []).storage.backend).toBe("memory");
+    expect(loadConfig({ GC_ACCESS_STORAGE_BACKEND: "memory" }, []).storage.backend).toBe("memory");
+    expect(loadConfig({ GC_ACCESS_STORAGE_BACKEND: "postgres" }, []).storage.backend).toBe("postgres");
+  });
+
   it("refuses to start when the database URL file is absent", () => {
     const missing = join(tempDir(), "database-url");
     const message = thrownMessage(() => loadConfig({ GC_ACCESS_DATABASE_URL_FILE: missing }, []));