Security fixes: malformed packet handling, thread safety, and per-connection isolation

[M-Tesla]

This PR addresses the security issues described in #.

Fixes

• Remote DoS via malformed packets: the server no longer crashes on BufferUnderflowException. Malformed requests now return Invalid request and the connection stays alive.
• Shared network buffer: replaced the single shared ByteBuffer with per-connection buffers attached to each SelectionKey.
• Thread-unsafe BufferPoolManager: synchronized all public methods to prevent torn writes and race conditions with the background checkpoint thread.
• Connection exhaustion DoS: added a connection limit of 256 concurrent clients.
• Information disclosure on delete: the full tuple slot is now zero-filled instead of only writing the tombstone ID.
• Invalid record IDs: reject IDs <= 0.
• Charset consistency: Tuple now uses explicit UTF-8 encoding.

Verification

• ./gradlew jar builds successfully.
• Smoke tests: 12/12 passed (INSERT, SELECT, UPDATE, DELETE, SELECT_ALL, duplicate key, malformed packet handling, server-alive checks).
• Stress test: 100 sequential malformed packets handled without crash; server remained functional.

Closes #1