Persist scratch query buffer content across restarts

[erikdarlingdata]

Split from #490 (and originally from #468's scope note, whose pointer to "#462" was dangling — nothing ever implemented buffer persistence). Session restore now survives crashes and remembers every FILE-backed tab, docked or detached (#495), but a never-saved scratch query still vanishes on any exit: there is no path to write down, and its content is not persisted anywhere.

Doing this properly is a feature, not a mirror fix, which is why it stayed out of #495:

• where buffers live (a session-scoped directory beside settings, presumably atomic-written like everything else);
• lifecycle (when to write — the Persist the session continuously so restore survives the exits it exists for #495 debounced trigger fires on membership changes, but content changes are per-keystroke scale and need their own cadence; when to delete — on clean close-without-save the user chose to discard at the Warn about unsaved query changes, and mark modified tabs (#462) #469 prompt, so persisting anyway would override an explicit choice; on crash there was no choice, which is exactly the case worth saving);
• size/privacy bounds (queries can embed literals someone did not expect written to disk unasked).

The #469 close prompts already guard every interactive discard route, so the residual loss today is scratch content on ABNORMAL exit only — real but narrow. The distinction between chose-to-discard and never-got-to-choose is the design center.

[erikdarlingdata]

Fixed by #498 (merged to dev): scratch buffers persist beside the settings file as recognizable .sql, ride the open_tabs list as inline scratch: entries (order-preserving, old builds skip them harmlessly), write on a 2s idle debounce with a 10s max-latency cap, and die exactly when chosen — Don't Save and Save delete directly, while never-chosen buffers survive crashes and even the cold-start file-arg launch (which now restores before opening, closing the review's blocking finding). The startup sweep is age-gated three days so crash bystanders linger recoverable instead of being destroyed. Ships in the next release.