v0.1.43

The MCP server can now run the query, not just pick the tables.

select_schema handed back DDL and the client's model wrote the SQL — and then there was nothing to execute it with. run_query takes one read-only SELECT and returns rows. No API key: the MCP client is already a model. answer() is there for an agent that has no model of its own, and without one configured it returns the selection and points at run_query rather than failing.

Withholding a table keeps meaning something. Every query is checked three ways before the database sees it — one statement, a read, and every table it names visible to this principal. Refused for an anonymous caller, for the wrong role, when the table is hidden inside a JOIN or a CTE, and when an earlier authorised call might have been mistaken for authorising this one. Unknown tables are refused too: from there, restricted and misspelled and never-reflected look identical.

Database errors come back in the database's own words, because the caller is a model whose next move is to fix the query.

The trust boundary is now written down. principal and roles are asserted by the client and this server believes them — no token, no session. Fine over stdio, or behind something that authenticates; not fine on an open port. A shared secret is not implemented yet.

Fixed: an object whose whole name is a shadow suffix (_BACKUP) was recorded as a copy of itself and demoted for shadowing itself.

858 tests, plus the property suite.