feat(controlplane): expose metadata Postgres proxy

[benben]

Summary

• add a native PostgreSQL metadata proxy on the existing Duckgres listener
• authenticate <org>.md.<region>.postwh.com with the org's existing root credential, while resolving the real metadata PgBouncer URL and role entirely inside the control plane
• support the managed-warehouse dev, prod-US, and prod-EU suffixes supplied by each deployment
• require the exact non-empty database name metadata
• gate access behind a default-off metadata_proxy_enabled org setting, exposed through the admin API and UI
• close active proxy sessions when the org becomes ineligible, is disabled/deleted, or the control plane drains

Security and scope

• only configured metadata SNI suffixes enter this path
• only root, an exact dbname=metadata, a ready cnpg-shard warehouse, and an explicitly enabled org are accepted
• clients cannot select the upstream host, database, role, password, or application_name
• upstream bootstrap has a 10-second deadline and connections have a configurable per-org cap
• internal connection details are omitted from errors and logs
• initial rollout is documented as dedicated/single-customer shards only; the proxied role intentionally retains full metadata-database access for this first scope
• PostgreSQL cancel keys are synthetic and never expose the upstream key; a cancel delivered to the owning control-plane process terminates that exact frontend/upstream session, while a key delivered to another process is safely ignored and counted

Observability

• add dedicated open-connection, attempt, duration, upstream-connect, byte, and cancel metrics
• keep org/outcome/direction labels bounded and document their relationship to existing process-wide connection/auth counters
• keep DuckDB worker, admission, query, session, log, and trace metrics unchanged for proxied metadata traffic

Validation

• just lint
• race-enabled metadata proxy and SNI tests
• explicit parsing and SNI-routing coverage for .md.dev.postwh.com, .md.us.postwh.com, and .md.eu.postwh.com
• config-store, config resolution, admin, and mw-dev test suites
• live mw-dev coverage for default deny, explicit enable, exact database enforcement, a real hidden-credential CNPG query, sibling-org isolation, and disable
• admin UI typecheck, 79 tests, and production build

just test-controlplane-k8s also passed the root, control-plane, and provisioner packages locally. Eight Docker-backed admin tests could not start because docker-compose is not installed; the complete non-Docker admin suite passed.

Deployment dependencies

• PostHog/posthog-cloud-infra#9680
• PostHog/charts#13717

[github-actions]

Test Impact Plan

Deterministic summary of how this PR changes tests, CI runners, and coverage-risk signals.

Summary

Area	Added	Changed	Deleted
Test files	1	9	0
E2E/journey files	0	0	0
Workflow files	0	0	0

Signals

• Test cases: +17 / -0
• Assertions: +113 / -0
• Skips or known failures added: 0
• Workflow continue-on-error added: 0
• Workflow path filters added: 0
• Test commands removed from justfile: 0
• E2E/journey retry lines added: 0

Coverage risk: neutral or increased

No coverage-reduction warnings detected.