Function matches_tls_refused_message 

fn matches_tls_refused_message(msg: &str) -> bool

Pure string check for the substrings tokio_postgres produces when the server refuses the TLS startup request (responds 'N' to the SSL byte).

Extracted from message_indicates_tls_refused so we can unit-test the substring list — the caller takes &tokio_postgres::Error, which has no public constructor.