security: remove hardcoded cluster.local URLs from source code

- activity/memory.go: read MEMORY_SERVICE_URL from env, default localhost
- pkg/db/db.go: remove cluster.local from DSN comment
- Fix memory_test.go env var name to match

pkg/db/db.go

@@ -17,7 +17,7 @@ type DB struct {
 }
 
 // New creates a new database connection to memory-db (K8s CNPG)
-// Expected DSN format: postgresql://app:password@memory-db-rw.poimen.svc.cluster.local:5432/memory?sslmode=disable
+// Expected DSN format: postgresql://app:password@host:5432/dbname?sslmode=disable
 func New(dsn string) (*DB, error) {
 	if dsn == "" {
 		// Fallback: try to construct from K8s env vars