refactor(relay): backend seams prep for local mode (PR 0/12)

[loganj]

PR 0 of 12 — Backend seams prep (local-mode graduation stack)

First PR of the local-mode graduation train (source branch wip-experiment-local-mode @ b3f365faf, re-cut as a 12-PR stack; plan in the buzz-experiment-local-mode channel canvas).

What this PR does

Mechanical seams-prep refactor with zero hosted-path behavior change:

• buzz-db-backend-macro crate (new, standalone): compile-time enforcement that every public Db method carries an explicit #[sqlite_backend(...)] decision marker, with trybuild compile-pass/fail coverage. No SQLite implementation code — the macro only enforces future declarations.
• Relay pubsub/media/presence/config seams: RelayProfile config enum (BUZZ_PROFILE, defaults to production; single-node fails fast at boot — constructor fence, no local backend installed yet), AppState::new_with_backends injection point, redis_pool becomes Option (always Some on the production path), pubsub/media/search backend selection moved behind startup-selected wrappers.
• Filesystem media backend hardening (pulled forward from the source branch per review): component-aware cross-platform key rejection (traversal, \\, drive/UNC paths), atomic same-directory temp-file writes/copies, seek + bounded take range reads, regression coverage for the traversal/Windows-separator boundary.

Explicitly out of this PR (lands in PR 1 where first exercised): the broad buzz-db/src/lib.rs backend-operation gating, all SQLite persistence, sidecar/desktop work.

Size

24 files, +1,414/−154 = 1,568 changed lines (stack budget: ≤2k after the PR 1 tracer).

Evidence

• cargo test -p buzz-media — 111 passed / 1 ignored (MinIO, infra-dependent)
• cargo test -p buzz-db-backend-macro — green (incl. trybuild UI tests)
• cargo test -p buzz-pubsub — 27 passed / 11 ignored
• cargo test -p buzz-db --lib — 94 passed / 154 ignored
• cargo test -p buzz-relay --lib at head vs plain origin/main (2777189d9): identical 858 passed / 9 failed / 40 ignored — the 9 are pre-existing/environmental on the dev host (local Postgres container down: SQLx pool timeouts, admin 404→500, mesh-demo 504) and reproduce byte-for-byte at base. CI's real-database run is the authoritative gate.
• Full pre-push hook suite green (rust-tests, desktop check/typecheck/test/tauri, mobile-test).

Review

Blocking review by Larry: initial 6/10 (filesystem media boundary needed the source branch's hardening family), fix round closed it, final 10/10 at exactly this head — no remaining blockers or suggestions.

Builder: Brother Darryl. Verification: Wakko (independent test reruns at exact head 8f29ecb).

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8f29ecbdb0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Document the public proc-macro entry point

enforce_sqlite_backend_declarations is a newly exported API but has no function-level documentation explaining its attribute syntax, generated inventory, or compile-time behavior. Add a /// comment to comply with the repository requirement that every new public API be documented.

AGENTS.md reference: AGENTS.md:L117-L117

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Propagate filesystem listing errors instead of panicking

The new non-test filesystem listing path calls unwrap() while processing directory entries, and the same function later introduces an expect() when constructing the continuation token. Replace these with normal error propagation through MediaError; production paths are explicitly prohibited from adding unwrap() or expect(), and a violated path invariant should fail the sweep rather than abort the process.

AGENTS.md reference: AGENTS.md:L116-L116

Useful? React with 👍 / 👎.