Teleport: any user can access any other user's clone

With the Teleport integration, any Teleport user who has access to dblab database resources can connect to any other user's clone. There is no per-user isolation.

Cause: the dblab_user label (and the clone's Postgres role) come from the db.username in the clone-create request, which the caller sets freely. The Engine has no concept of who created a clone - API auth is a shared verification token (no identity) or a personal Platform token whose check returns only org_id + is_personal.

So a Teleport role like:

allow:
  db_labels:
    dblab_user: ['{{email.local(external.email)}}']

cannot be trusted as a boundary, because nothing ties the label to the authenticated user.

Proposal

Derive the clone's Postgres role and dblab_user label server-side from the authenticated user's email local part (from the personal Platform token), behind an opt-in flag. Then the db_labels rule above restricts each user to their own clones.

Requires personal per-user tokens; with the shared verification token there is no identity to bind to.