Remove URL-unsafe characters from gen-secret charset

Remove ^, +, ~, :, @ from the allowed charset. The ^ character breaks
SQLAlchemy DATABASE_URL parsing, + becomes space in URL query strings,
: and @ are URL delimiters. The remaining charset (A-Za-z0-9._-) is
safe in URLs, database connection strings, YAML, JSON, and shell
without any encoding.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

scripts/gen-secret

@@ -1,14 +1,14 @@
 #!/usr/bin/env bash
 set -uo pipefail
 
-CHARSET='A-Za-z0-9._+\-:@^~'
+CHARSET='A-Za-z0-9._\-'
 DEFAULT_LENGTH=32
 
 usage() {
     cat <<'EOF'
 Usage: gen-secret [OPTIONS] [LENGTH]
 
-Generate a cryptographically random string safe for bash, YAML, and JSON.
+Generate a cryptographically random string safe for bash, YAML, JSON, and URLs.
 
 Arguments:
   LENGTH    Number of characters (default: 32)