fix(connectors): allow self-hosted private DB hosts via opt-in flag (#5322)

* fix(connectors): allow self-hosted private DB hosts via opt-in flag

Database/connector tools rejected any host resolving to a private/reserved/
loopback IP, blocking the common self-hosted topology where the DB is reached
by a Docker/K8s/Swarm service name. Add an opt-in ALLOW_PRIVATE_DATABASE_HOSTS
flag that bypasses the private-host block in validateDatabaseHost while still
resolving and pinning DNS. Blocked on the hosted platform regardless of the env
var, mirroring DISABLE_AUTH.

Fixes #4319

* fix(connectors): pin postgres IP in all ssl modes; strip IPv6 brackets

Address review on #5322:
- validateDatabaseHost now strips surrounding IPv6 brackets before the
  localhost/private-IP checks and DNS lookup, so a bracketed loopback like
  [::1] is classified correctly instead of failing as unresolvable.
- PostgreSQL connector always connects to the validated, pinned IP (removed
  the ssl='preferred' carve-out that passed the original hostname and let the
  driver re-resolve during connection). Matches the MySQL/MongoDB pin pattern.
- Add postgres connector pinning tests and bracketed-IPv6 host tests.

* fix(connectors): rename flag to isPrivateDatabaseHostsAllowed; trim comment

- Rename env-flag const to satisfy the env-flags 'is' prefix CI check
  (env var ALLOW_PRIVATE_DATABASE_HOSTS is unchanged).
- Tighten the postgres pinning comment to a single line.

packages/testing/src/mocks/env-flags.mock.ts

@@ -17,6 +17,7 @@ export const envFlagsMock = {
   isBillingEnabled: false,
   isEmailVerificationEnabled: false,
   isAuthDisabled: false,
+  isPrivateDatabaseHostsAllowed: false,
   isRegistrationDisabled: false,
   isEmailPasswordEnabled: false,
   isTriggerDevEnabled: false,