feat: public_port for managed databases — opt-in 0.0.0.0 bind

Managed databases have always published their port on 127.0.0.1 only.
public_port opts into binding on all interfaces so the database is
reachable off-host. Toggling via PUT recreates the container — the
named data volume survives.

- create accepts public_port; PUT /databases/{id} toggles it
- external rows reject the flag (no container exists)
- CLI: databases create --public, databases update --public/--public=false
- MCP: databases_update tool; UI: create checkbox + per-row toggle

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

docs/api/openapi.yaml

@@ -6319,6 +6319,9 @@ components:
           type: string
           enum: [managed, external]
           description: managed = Containr-provisioned container; external = registered connection to a database hosted elsewhere
+        public_port:
+          type: boolean
+          description: managed only — bind the database port on all interfaces instead of 127.0.0.1; toggling recreates the container
         external:
           $ref: '#/components/schemas/DatabaseExternal'
         next_backup_at:
@@ -6362,6 +6365,9 @@ components:
         region:
           type: string
           description: Database region
+        public_port:
+          type: boolean
+          description: Bind the database port on all interfaces (default 127.0.0.1)
 
     DatabaseExternal:
       type: object
@@ -6420,6 +6426,9 @@ components:
           type: string
           nullable: true
           description: Cron expression for automatic backups; empty string clears the schedule
+        public_port:
+          type: boolean
+          description: Toggle the published port between 127.0.0.1 and all interfaces; recreates the managed container
 
     DatabaseActionRequest:
       type: object

docs/guides/CLI.md

@@ -47,7 +47,9 @@ deployments list|get|logs|rollback|cancel
 logs <service-id> [--follow]     runtime logs (SSE follow)
 exec <service-id> -- <cmd>       one-off container command
 variables list|set|unset         env vars (secrets masked; --redeploy applies them)
-databases list|get|create|delete|action|backup|restore|download-backup
+databases list|get|create|update|delete|action|backup|restore|download-backup
+                               create --public exposes the port on all interfaces;
+                               update <id> --public/--public=false toggles it (container recreates, data persists)
 databases register <name>      register an external database (--type --host --port --database --username --password --ssl; probed before storing)
 databases test-connection      probe a connection — by id, or ad-hoc flags
 cron list|get|create|delete|trigger|executions