* config: add DB_SSLMODE for managed/remote PG * streaming: set PG sslmode, defaults to prefer
* add ffmpeg initializer * use different expression to check for environment var