[psteinroe]

Based on #879, which needs to merge first. It doesn't depend on #903, #907 or #920.

allowStatementExecutionsAgainst ignored the port. Patterns were matched against host/database, and the docs recommended ["localhost/*", "127.0.0.1/*"]. A port forward, an SSH tunnel, cloud-sql-proxy, fly proxy or pgbouncer make a remote database reachable on localhost as well, on another port, so the recommended patterns also allowed executing statements against production:

"allowStatementExecutionsAgainst": ["localhost/*"]
// postgres://...@localhost:5432/postgres   allowed
// postgres://...@localhost:15432/postgres  allowed too, e.g. an SSH tunnel to production

There was also no way to name the port: localhost:5432/* never matched, because the target string had no port.

What changed

• A pattern that names a port is matched against host:port/database: 127.0.0.1:54322/* only allows port 54322, and localhost:*/dev allows dev on any port. A pattern names a port if its host part, the part before the first /, has exactly one :.
• A pattern without a port keeps matching host/database and allows every port, as before. The docs say so and explain why to name the port.
• An IPv6 address can't be combined with a port, since its colons are ambiguous. ::1/* matches every port of ::1, as before.
• The docs use port-specific patterns: 127.0.0.1:5432/*, and 127.0.0.1:54322/* for a local Supabase project. The config field now has a description, so docs/schema.json, the CLI reference and the TS bindings explain the matching.
• The disabled reason names the port and suggests a port-specific pattern: "Statement execution is disabled for 127.0.0.1:5432/postgres. Add a matching pattern to db.allowStatementExecutionsAgainst, e.g. ["127.0.0.1:5432/*"]."
• DatabaseSettings::default().allow_statement_executions is false. It made no difference before, because the default also disables the connection, but a default should not allow executions.

For the changelog

Behavior change: patterns in db.allowStatementExecutionsAgainst can name a port (host:port/database) and then only allow that port. Patterns without a port still allow every port. A pattern whose host part had exactly one :, which could never match before, now matches against host:port/database. Consider switching localhost/* to localhost:5432/*.

Tests

• patterns_with_a_port_only_match_that_port, patterns_without_a_port_match_every_port (including ::1/*).
• connection_string_port_is_matched: localhost:54322/* allows the connection string on port 54322 but not a tunnel on 15432.
• disabled_reason_suggests_a_pattern_with_the_port, for IPv6 too, and statement_executions_are_disallowed_by_default.
• The expected disabled reasons in the existing settings and workspace tests now include the port.

Not covered

Existing configs with localhost/* keep allowing every local port. Making port-less patterns match only the default port would break configs without a warning, so this PR only changes the docs and the suggested pattern.