fix(db): let a PgBouncer host turn the session startup options off

The statement timeout and, since v1.42, work_mem reach Postgres as the
libpq options startup parameter, which PgBouncer refuses unless it is in
ignore_startup_parameters. A host behind it could drop the string by
setting the timeout to 0; work_mem is now always sent, so that no longer
worked. DATABASE_SESSION_OPTIONS_DISABLED sends no session settings,
documented in the example env, the env manifest, the compose whitelist
and the scaling guide.

docs/self-hosting/scaling.md

@@ -188,6 +188,14 @@ already`. Either raise `max_connections` on the Postgres side, lower
 `DATABASE_POOL_MAX`, or front the database with PgBouncer in
 transaction-pooling mode.
 
+The app sets its statement timeout and `work_mem` on every connection
+through the libpq `options` startup parameter. PgBouncer refuses that
+parameter (`unsupported startup parameter: options`) unless it is listed
+in `ignore_startup_parameters`. Either list it there, or set
+`DATABASE_SESSION_OPTIONS_DISABLED=1` so the app sends no session
+settings; set the timeout and `work_mem` on the database role instead
+(`ALTER ROLE healthlog SET work_mem = '16MB'`) if you still want them.
+
 ### Overriding the per-container pool ceiling
 
 With the bundled compose, set `DB_CONNECTION_LIMIT` in `.env`; it