…it database

Address review feedback: the proxy now runs exactly one postgres listener.
The top-level postgres: block is a single object with a `listen` address and a
`routes` list (no longer a list of named listeners). Clients must name a
database explicitly — the proxy no longer falls back to the user name — and an
unspecified or unmatched database is rejected with FATAL 3D000.

LoadFromNode/Compile now yield a single *Listener; the Manager owns one server.
In managed mode the synced routes are layered onto the single listener: the
bind address comes from the local YAML listener when present, otherwise
IRON_PROXY_PG_LISTEN, and a synced route whose database collides with a local
route (or another synced route) is dropped.

Per review: the per-database entries are now `upstreams` (plural) and the DSN is
a first-class field on each entry rather than nested under `upstream.dsn`:

  postgres:
    listen: ":5432"
    upstreams:
      - database: appdb
        dsn: {type: env, var: PG_APPDB_DSN}
        client: {user: app_user, password_env: PG_APPDB_PROXY_PASSWORD}
        role: tenant_role

The compiled Route type is renamed Upstream throughout (Listener.Upstream/
Upstreams, NewManagedUpstream, etc.). No behavior change.

A client connecting with dbname=X must land on database X upstream, otherwise
current_database() and friends silently diverge from what the client asked for.
dialUpstream now parses the resolved DSN and refuses to connect when its
database differs from the upstream's routing database, surfacing a FATAL 3D000
to the client. The check runs at connection time since the DSN is a
lazily-resolved secret source.

Reworks the multi-upstream integration test to route to two distinct real
databases (adds a second database to the fixture) and adds end-to-end coverage
of the mismatch rejection, plus unit tests for the check.

The per-upstream database is now required in the control-plane sync path too
(PostgresFromSync errors when it's absent rather than defaulting to foreign_id),
matching the YAML config which already required it. dialUpstream additionally
rejects a DSN that names no database (FATAL 3D000) so the database/DSN match
check is never comparing against an empty value.

… per-upstream env vars

Managed mode no longer reads per-upstream client credentials from
IRON_PROXY_PG_<FOREIGN_ID>_CLIENT_USER/_CLIENT_PASSWORD. Each sync entry now
carries client_user and client_password inline (both required), so the control
plane delivers the complete upstream and the proxy needs no per-upstream
configuration. The single listener bind address is unchanged: local YAML
postgres.listen, or IRON_PROXY_PG_LISTEN. Removes the now-unused pgEnv helper.

…er-upstream creds

Routing is keyed on database, so per-upstream client credentials add nothing.
Move the client user/password to the listener: YAML carries one top-level
`client: {user, password_env}`, and managed mode reads a single shared
IRON_PROXY_PG_CLIENT_USER / IRON_PROXY_PG_CLIENT_PASSWORD (or inherits the local
listener's credential). Upstreams now carry only database, dsn, and role; the
sync entry drops client_user/client_password. Auth verifies against the
listener's shared credential. Synced upstreams are deduped before building,
keeping the local-merge and env-built paths consistent.