feat: public_port for managed databases — opt-in 0.0.0.0 bind

Managed databases have always published their port on 127.0.0.1 only.
public_port opts into binding on all interfaces so the database is
reachable off-host. Toggling via PUT recreates the container — the
named data volume survives.

- create accepts public_port; PUT /databases/{id} toggles it
- external rows reject the flag (no container exists)
- CLI: databases create --public, databases update --public/--public=false
- MCP: databases_update tool; UI: create checkbox + per-row toggle

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

docs/api/openapi.yaml

@@ -6319,6 +6319,9 @@ components:
           type: string
           enum: [managed, external]
           description: managed = Containr-provisioned container; external = registered connection to a database hosted elsewhere
+        public_port:
+          type: boolean
+          description: managed only — bind the database port on all interfaces instead of 127.0.0.1; toggling recreates the container
         external:
           $ref: '#/components/schemas/DatabaseExternal'
         next_backup_at:
@@ -6362,6 +6365,9 @@ components:
         region:
           type: string
           description: Database region
+        public_port:
+          type: boolean
+          description: Bind the database port on all interfaces (default 127.0.0.1)
 
     DatabaseExternal:
       type: object
@@ -6420,6 +6426,9 @@ components:
           type: string
           nullable: true
           description: Cron expression for automatic backups; empty string clears the schedule
+        public_port:
+          type: boolean
+          description: Toggle the published port between 127.0.0.1 and all interfaces; recreates the managed container
 
     DatabaseActionRequest:
       type: object