fix: harden security and improve performance across the codebase

[johnny-emp]

Summary

• SQL injection fixes: Parameterized queries in scheduler list_tasks, strict input validation in DLQ replayer ByErrorType, and SQL identifier validation in azoth-vector VectorSearch::new to prevent injection via table/column names.
• Credential safety: IpfsProvider now redacts api_key and secret_key from Debug output to prevent accidental exposure in logs. Unsafe extension loading in azoth-vector is documented with safety requirements.
• Performance improvements: Benchmark reads use read-only transactions; LMDB read pool uses exponential backoff instead of spin-wait; SQLite read pool uses round-robin connection selection to reduce contention; FileEventLog gains a configurable flush_on_append option for deferred flushing.
• Documentation: Corrected preflight cache eviction docs (FIFO, not LRU); added comprehensive SyncMode durability docs; documented EventProcessor batch size recommendations; added a Performance Tuning section to AGENTS.md.

Files Changed (15)

Area	Files	Change
Security	azoth-scheduler/src/projection.rs, azoth/src/dlq_replayer.rs, azoth-vector/src/search.rs, azoth-vector/src/extension.rs, azoth/src/ipfs.rs	SQL injection fixes, credential redaction, unsafe docs
Performance	azoth-lmdb/src/read_pool.rs, azoth-sqlite/src/read_pool.rs, azoth-file-log/src/store.rs, azoth/benches/basic_benchmark.rs	Backoff, round-robin, deferred flush, read txn for benchmarks
Docs	AGENTS.md, azoth-core/src/config/canonical.rs, azoth-lmdb/src/preflight_cache.rs, azoth/src/event_processor.rs	SyncMode, cache eviction, batch sizing, tuning guide
Adapters	azoth-vector/src/lib.rs, azoth-vector/tests/integration_test.rs	Updated for VectorSearch::new returning Result

Test plan

• cargo check --workspace passes
• cargo clippy --workspace passes with no warnings
• cargo test --workspace – all 183 tests pass
• New tests: test_replay_priority_by_error_type_validation, test_identifier_validation_rejects_injection

Made with Cursor