fix: require DBLab for database-backed previews

[NikolayS]

Summary

• add one fail-closed resolver for preview database policy
• enforce it during TOML validation, programmatic app registration, trigger/rebuild resolution, and env create before any remote mutation
• keep static apps and node apps that explicitly declare dbBackend = "none" as no-database exemptions
• retain the legacy behavior that an undeclared backend is database-backed and therefore defaults to DBLab

Root cause

The platform treated previewDbBackend = "none" and "template" as valid operator overrides even for applications that carry a database. A direct env create --db none|template request could also bypass the app's intended DBLab policy. That made isolation depend on each manifest and caller being perfectly configured, allowing a database-backed preview to start without a DBLab clone and potentially inherit production-facing connection configuration.

This change centralizes the classification and fails before state, DNS, SSH, or host mutation whenever a database-backed app resolves to anything except dblab.

Static apps (kind = "static") and explicit no-database node apps (dbBackend = "none" with no database signals) resolve to none and do not allocate DBLab.

Validation

• bun test
• 1782 passed, 0 failed
• 80 test files / 6393 assertions

The branch only contains the policy implementation and corresponding test updates. It does not change or deploy the live control-plane trigger.