fix: resolve issues #36–#44 — security, robustness, and correctness

[farhan-syah]

Summary

Fixes 9 issues (14 sub-problems) spanning WAL crypto, memory safety, OOM, performance, DoS hardening, and pgwire correctness.

• AES-GCM nonce reuse in WAL encryption on LSN rewind / snapshot restore #36 — AES-GCM nonce reuse: add random 4-byte epoch to nonce, preventing reuse after WAL truncation/snapshot restore
• Integer overflow in mmap vector segment header enables OOB read (memory unsafety) #37 — mmap vector segment integer overflow: checked_mul/checked_add in header parsing, dim=0 rejection, bounds checks in get_vector/prefetch
• Columnar memtable never flushes — unbounded memory growth on INSERT #38 — Columnar memtable never flushes: wire should_flush → drain_optimized → SegmentWriter persist → scan from flushed segments
• GROUP BY aggregate materialises every matching document in memory #39 — GROUP BY materializes all docs: replace HashMap<String, Vec<Vec<u8>>> with streaming AggAccum accumulators (O(groups) memory)
• SQ8-quantized sealed segments bypass HNSW graph navigation (O(N) brute-force per query) #40 — SQ8 search does O(N) linear scan: replace brute-force loop with HNSW graph-guided candidate generation + FP32 rerank
• Unbounded-input DoS hardening — ef_search, TLS handshake, ILP line, SQL expr depth #41.1 — ef_search unbounded: clamp to MAX_EF_SEARCH = 8192
• Unbounded-input DoS hardening — ef_search, TLS handshake, ILP line, SQL expr depth #41.2 — TLS handshake no timeout: 10s tokio::time::timeout on all 3 listeners
• Unbounded-input DoS hardening — ef_search, TLS handshake, ILP line, SQL expr depth #41.3 — ILP unbounded line: MAX_ILP_LINE_BYTES = 10 MiB cap with read_until
• Unbounded-input DoS hardening — ef_search, TLS handshake, ILP line, SQL expr depth #41.4 — Expr parser stack overflow: MAX_EXPR_DEPTH = 128 in parser + resolver
• WAL & recovery robustness — short-write handling, reader recursion, decode panics #42.1 — WAL short write ignored: retry loop + correct data.len() offset
• WAL & recovery robustness — short-write handling, reader recursion, decode panics #42.2 — WAL reader self-recursion: convert to loop in both reader.rs and mmap_reader.rs
• WAL & recovery robustness — short-write handling, reader recursion, decode panics #42.3 — WAL decode panics on truncated payloads: read_slice helper + MAX_FIELD_LEN cap
• pgwire extended-query protocol rejects DSL statements (SEARCH / GRAPH / UPSERT / MATCH) — forces simple-query + string interpolation #43 — pgwire extended protocol rejects DSL: is_dsl flag routes SEARCH/GRAPH/MATCH/UPSERT to DSL dispatcher
• pgwire SELECT on TYPE DOCUMENT STRICT silently returns null/empty columns via extended protocol (data loss) #44 — STRICT doc SELECT returns null via extended protocol: reproject_response extracts typed columns from JSON envelope

Also fixes a silent data-loss bug in encode_row_for_wal that swallowed serialization errors via unwrap_or_default().

Test plan

• 17 new tests across 7 files — all pass
• 680/680 shared crate tests pass (nodedb-wal, nodedb-vector, nodedb-columnar, nodedb-query, nodedb-sql)
• 2834/2835 core crate tests pass (1 pre-existing flaky cluster test)
• Full SQL test suite (scripts/test.sh) passes — zero regressions across ~400 query results
• cargo fmt --all clean
• cargo clippy --all-targets clean

Closes #36, closes #37, closes #38, closes #39, closes #40, closes #41, closes #42, closes #43, closes #44