fix(sql): close the opened client on New's post-open error paths (connection-handle leak)

[thalesfsp]

Problem

Class: correctness / resource-hygiene (not SecOps).

The mysql, postgres, and sqlite New constructors open a *sqlx.DB with sqlx.Open (which does not dial), then verify liveness with a retried Ping and run validation.Validate. On the ping-failure and validation-failure returns, the opened handle was neither returned to the caller nor closed — leaking the underlying database/sql connection pool every time construction failed after Open (e.g. an unreachable DB, a flapping endpoint, or startup before the DB is ready).

• What this fixes: the leaked *sqlx.DB (and its pool) on every failed-after-open New.
• Why it matters: repeated failed constructions (retry loops, health-check-then-reconnect, transient DB outages) accumulate orphaned pools/goroutines/FDs that are never reclaimed.
• Blocking: nothing — standalone hygiene fix.

Identical bug in all three storages:

• mysql/mysql.go New — ping-failure return + validation-failure return
• postgres/postgres.go New — same
• sqlite/sqlite.go New — same

Fix

Guard the opened client with a single deferred close controlled by a success flag that only flips true immediately before the successful return. Every post-open error path (ping, validation, and any future one) now closes the client exactly once; the success path does not. Signatures, the success path, and error values are unchanged.

client, err := sqlx.Open(cfg.DriverName, cfg.DataSourceName)
if err != nil { return nil, ... } // no client on this path

success := false
defer func() { if !success { _ = client.Close() } }()

// ... retried Ping (on failure: return nil, err) ...
// ... build storage; validation.Validate (on failure: return nil, err) ...
singleton = storage
success = true
return storage, nil

Test (TDD + negative control, offline)

Each package gets *_leak_test.go that drives the ping-failure path against an injected, in-process counting database/sql driver (Ping always fails; Open/Close increment atomic counters, Close guarded by sync.Once), then asserts the opened handle was closed (closes >= opens). It also asserts opens > 0 so it can't pass vacuously.

• Fully offline: in-process driver, ignored fake DSN — no real DB, no network.
• Fast: shrinks shared.TimeoutPing to 1ms (restored via t.Cleanup) so the retrier exhausts in ~1s instead of ~70s.
• Negative-control verified: with the guard neutralised the test fails with opened 1 connection(s) but closed only 0; restored, it passes.

An unexported driverName package var (defaulting to Name) is the test seam used to point New at the counting driver; production never changes it.

make test is green; gofmt and go vet are clean.

Validation

Independently reviewed with codex (REFUTE gate): confirmed all post-open error returns close the client, no double-close, no success-path regression, signatures unchanged, and the test is offline and negative-controlled.