feat(auth): bind console-created clones to users via forwarded email

Clones created through the Platform console get no dblab_user label, while clones created via the CLI with a personal token are bound correctly.

The console proxies all Engine calls through the Platform with the shared verification token - an identity-less credential - so ownerFromContext never sees a user and the clone stays unlabeled. The Platform cannot replay the member's personal token (it stores bcrypt hashes only), so the identity is conveyed explicitly instead.

The auth middleware now accepts an X-Forwarded-User-Email header on requests authenticated with the shared verification token and attaches the asserted identity to the request context; the existing clone-owner labeling path works unchanged. The header is ignored on personal-token requests and when authorization is disabled. No privilege change: the shared token is already full-admin, and the dblab_user label grants access to the named user, not to the caller.

Platform side: postgres-ai/platform-all#539. Deployment order is flexible - an older Engine ignores the header, and binding only activates where platform.bindClonesToUser is enabled.

Closes #731 (closed).