[codex] Fix Postgres managed SNI dbname routing

[bill-ph]

Summary

• make Postgres managed SNI/dbname auth snapshot-atomic
• keep explicit startup database as the routing database when present
• require managed SNI and requested database to resolve to the same org
• add DNS-safe org-name SNI resolution for hyphenated org hostnames with underscore database names
• keep database_name SNI fallback and Flight behavior for follow-up PRs

Validation

• go test ./controlplane/configstore -run TestDatabaseNameForSNIPrefix|TestResolveSNIPrefix|TestResolvePostgresConnection
• go test -tags kubernetes ./controlplane -run TestPostgres|TestFlightValidator
• go test ./controlplane/configstore
• go test ./controlplane
• go test -tags kubernetes ./controlplane
• just test-controlplane-k8s
• just lint
• git diff --check origin/main...HEAD

Split context

This is PR1 from the larger SNI/dbname split. It leaves database_name SNI fallback and Flight behavior unchanged so those can be reviewed separately.