Pass NATS credentials explicitly: async-nats ignores userinfo in the URL

async_nats::connect() silently drops user:pass embedded in NATS_URL,
so the server rejected every connection with an authorization violation.
Parse the URL and feed credentials through ConnectOptions instead.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Cargo.toml

@@ -21,6 +21,7 @@ tower = { version = "0.5", optional = true }
 tower-http = { version = "0.6", features = ["fs", "trace"], optional = true }
 tower-sessions = { version = "0.14", optional = true }
 async-nats = { version = "0.38", optional = true }
+url = { version = "2", optional = true }
 sqlx = { version = "0.8", default-features = false, features = [
     "runtime-tokio",
     "tls-rustls",
@@ -65,6 +66,7 @@ ssr = [
     "dep:tower-http",
     "dep:tower-sessions",
     "dep:async-nats",
+    "dep:url",
     "dep:sqlx",
     "dep:openidconnect",
     "dep:futures",