fix: harden SQL quoting, TLS handling, and async operations

[christian-smith]

Summary

Security hardening and reliability fixes for database replication operations.

• Prevent SQL injection with parameterized queries and consistent identifier quoting
• Fix TLS certificate handling to be secure by default
• Fix async/await correctness issues
• Expand remote filter options

Changes

Security

• SQL injection prevention: Converted string interpolation to parameterized queries in monitor.rs for replication stats
• Consistent identifier quoting: Added quote_ident(), quote_literal(), and quote_mysql_ident() helpers used consistently across all DDL statements
• Credential leak prevention: Removed connection strings from error messages in MySQL validation
• TLS secure by default: Changed from accepting all certificates to requiring valid certs, with opt-in --allow-self-signed-certs flag for testing

Reliability

• Async fixes: Added missing .await calls to retry_subprocess_with_backoff()
• Non-blocking retries: Replaced std::thread::sleep() with tokio::time::sleep().await in async context
• Thread-safe TLS config: Replaced unsafe std::env::set_var() with OnceLock for TLS policy

Features

• Remote filter expansion: Added exclude_databases and include_tables to FilterSpec
• Job timeout passthrough: Now sends job_timeout_seconds to remote orchestrator

Testing

• All 272 tests passing
• Clippy clean (no warnings)
• Security test updated to verify credential leak fix