fix(nexus-db): cross-review findings

- source build.func (script was unrunnable without it)
- validate DB_NAME/DB_USER/DB_PORT/NEXUS_APP_IP before SQL/pg_hba use
- rotate password when role exists but credentials file is missing

ct/nexus-db.sh

@@ -28,6 +28,8 @@ DEFAULT_DB_NAME="nexus"
 DEFAULT_DB_USER="nexus"
 DEFAULT_DB_PORT="5432"
 
+source <(curl -fsSL "$LIB_URL/build.func")
+
 # ── app-specific prompts (host TTY; each skipped if the var is preset) ───────
 prompt_app_config() {
   echo