Bind public Odoo runtime to configured database

[cbusillo]

Summary

• Add an exact-match dbfilter for non-local/public Odoo runtimes based on the configured ODOO_DB_NAME.
• Pass the same public runtime --db-filter to Odoo init/server commands while keeping shell commands filter-free.
• Document the public single-database binding contract and cover local/public behavior in startup tests.

Why

The cm_website/testing Launchplane stable bootstrap now propagates the canonical URL, but the public Odoo host still falls through to /web/database/selector and /cell-mechanic reports no database selected. Public single-database runtimes need HTTP database routing pinned to the configured tenant DB before the website canonical proof can pass.

Validation

• uv run python -m unittest tests.test_odoo_startup
• uv run ruff check --exit-zero docker/scripts/run_odoo_startup.py tests/test_odoo_startup.py
• uv run ruff check docker/scripts/run_odoo_startup.py tests/test_odoo_startup.py
• uv run python -m unittest discover -s tests
• git diff --check

Review

Focused read-only agent review found the initial public/local scope mismatch; this PR version gates dbfilter to public runtimes, adds local non-regression tests, covers the init command, and asserts shell commands stay filter-free.