feat(security): auth-gate cluster routes, enforce GRANT/REVOKE, cap decompression, redact credentials

[austin-barrington]

Security hardening for v0.8.5-beta:

• Gate /internal/replicate and raft cluster routes behind auth middleware ([CRITICAL] Raft/cluster routes mounted outside auth — unauthenticated cluster takeover #92, [HIGH] /internal/replicate disables body limit — unauthenticated memory exhaustion #95)
• Enforce per-database GRANT/REVOKE for non-admin users, fix docs that incorrectly said these were no-ops (V1 [SEC] GRANT/REVOKE are no-ops — false sense of security #72, V1 [SEC] Per-database authorization check is vestigial — no actual enforcement #77)
• Cap gzip decompressed body size to prevent decompression bombs ([HIGH] gzip decompression bomb on /write — no decompressed-size cap #93)
• Require auth on statement summary endpoint, redact passwords in ring buffer (V1 [SEC] Statement summary endpoint is unauthenticated #75, V1 [SEC] Passwords exposed in statement summary ring buffer #76)
• Validate origin node ID on replication endpoints against cluster membership (chore: update docs index with quick start example #13)
• Add configurable replicate body limit with auto-resolution ([HIGH] /internal/replicate disables body limit — unauthenticated memory exhaustion #95)
• Validate IPC segment lengths in WAL decode to prevent OOM
• Escape backslashes in backtick-quoted identifiers
• Replace hand-rolled base64 decoder with base64 crate ([LOW] Security hardening — miscellaneous low-severity findings #96)
• Use saturating_mul for precision timestamp overflow (feat(release): optimise the release builds #16)
• Add WAL writer supervision, writer_alive health signal ([HIGH] WAL writer thread is unsupervised single point of failure #94)
• Add disk space monitoring with statvfs, Prometheus gauges, and read-only mode (V1 [OPS] Disk space monitoring and guardrails #64)
• Add CQ scheduler end-to-end validation (V1 [BUG] Continuous query execution is a silent no-op #63)
• Add security integration tests for auth gating and privilege enforcement
• Update authentication, configuration, and replication docs