Add temporary database access for diagnostics

[davejohnson]

Summary

• add a provider-neutral, operation-scoped database access lease for hv_db_query
• create and remove Railway TCP proxies only when no reachable database URL or existing proxy is available
• share concurrent access by reference count, expire abandoned leases, and retry idempotent cleanup
• enforce PostgreSQL read-only transactions, a 30-second timeout, and bounded diagnostic results
• return safe access/cleanup metadata and record credential-free query audit events
• add provider, concurrency, cleanup, execution-boundary, audit, and tool tests

Why

hv_db_query could not diagnose an internal-only managed database without a manually configured public URL. Existing Railway proxy support was designed for durable migration access and did not provide an operation-scoped create/use/cleanup lifecycle for diagnostic queries.

Impact

Managed Railway databases can now be queried for diagnostics without permanent public exposure. Existing access is reused and never deleted; access created by the query is released in finally. Cleanup failures preserve valid query results but return an explicit warning and stop instruction.

Validation

• tsc --noEmit
• npm run build
• npm run docs:tools
• npm test — 106 files, 903 tests passed

Closes #7