feat: add CheckScopedForeignKey node type to registry

[pyramation]

Summary

Adds CheckScopedForeignKey to the node type registry — a BEFORE INSERT trigger validator that prevents cross-scope FK linking.

Problem: On junction tables (e.g. view_table with view_id + table_id), a user with access to multiple databases can INSERT a row linking records from different databases. RLS only checks "can you access this row" — it doesn't validate that all FKs point to the same scope.

Solution: New Check* category node type with parameter_schema:

{
  scope_field: 'database_id',  // optional — also validates NEW.scope_field matches
  references: [
    { field: 'view_id', ref_table: 'view', ref_scope_field: 'database_id' },
    { field: 'table_id', ref_table: 'table', ref_scope_field: 'database_id' }
  ]
}

The generator (in constructive-db) creates a BEFORE INSERT trigger that SELECTs each target's scope value and raises if any mismatch. Works for junction tables (2+ refs) and child tables (1 ref validated against the row's own scope field).

Companion PR: constructive-io/constructive-db (generator + table_module dispatch).

Link to Devin session: https://app.devin.ai/sessions/12842f98263d4815b6713291efc825ad
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring