refactor(security): move all database access into pkg/security/lookup

pkg/security no longer contains SQL. Every provider calls a store interface
from lookup, implemented by a procedure backend (Postgres stored procedures,
the default there) and a direct backend (dialect-driven SQL for postgres,
sqlite, mysql and mssql with configurable table and column names).

- add sectypes, lookup, lookup/{dialect,procedure,direct,backends,ddl,conformance}
- split totp and providers sub packages out of the core package
- replace SQLNames/TableNames/QueryMode with lookup.Config (see breaking_changes.md)
- direct backend now covers column/row security and API-key login
- move txsettings SQL to lookup.ApplyTxSettings; remove password.go
- move schema scripts under lookup/, add reference DDL per dialect
- add a shared conformance suite; run it on sqlite, and on Postgres in a
  podman/docker container (RESOLVESPEC_TEST_CONTAINERS=1)
- fix procedure schema bugs found on real Postgres: duplicate p_data
  parameter, JSON null arrays, expires_at timezone casts, passkey list
  GROUP BY, missing resolvespec_passkey_login; accept zone-less timestamps

pkg/common/adapters/database/bun.go

@@ -275,6 +275,14 @@ func (b *BunAdapter) GetUnderlyingDB() interface{} {
 	return b.getDB()
 }
 
+// SQLDB implements common.SQLDBProvider.
+func (b *BunAdapter) SQLDB() *sql.DB {
+	if db := b.getDB(); db != nil {
+		return db.DB
+	}
+	return nil
+}
+
 func (b *BunAdapter) DriverName() string {
 	// Normalize Bun's dialect name to match the project's canonical vocabulary.
 	// Bun returns "pg" for PostgreSQL; the rest of the project uses "postgres".

pkg/common/adapters/database/gorm.go

@@ -2,6 +2,7 @@ package database
 
 import (
 	"context"
+	"database/sql"
 	"fmt"
 	"reflect"
 	"strings"
@@ -227,6 +228,20 @@ func (g *GormAdapter) GetUnderlyingDB() interface{} {
 	return g.getDB()
 }
 
+// SQLDB implements common.SQLDBProvider. It returns nil when GORM has no *sql.DB
+// (for example a ConnPool that is not database/sql).
+func (g *GormAdapter) SQLDB() *sql.DB {
+	db := g.getDB()
+	if db == nil {
+		return nil
+	}
+	sqlDB, err := db.DB()
+	if err != nil {
+		return nil
+	}
+	return sqlDB
+}
+
 func (g *GormAdapter) DriverName() string {
 	return normalizeGormDriverName(g.getDB())
 }

pkg/common/adapters/database/pgsql.go

@@ -223,6 +223,11 @@ func (p *PgSQLAdapter) GetUnderlyingDB() interface{} {
 	return p.db
 }
 
+// SQLDB implements common.SQLDBProvider.
+func (p *PgSQLAdapter) SQLDB() *sql.DB {
+	return p.db
+}
+
 func (p *PgSQLAdapter) DriverName() string {
 	return p.driverName
 }

pkg/common/interfaces.go

@@ -2,6 +2,7 @@ package common
 
 import (
 	"context"
+	"database/sql"
 	"encoding/json"
 	"io"
 	"net/http"
@@ -38,6 +39,15 @@ type Database interface {
 	DriverName() string
 }
 
+// SQLDBProvider is implemented by adapters that wrap a *sql.DB (directly or through an ORM).
+// It lets packages that work on database/sql, such as pkg/security/lookup, reuse the
+// connection an application already configured. Transaction adapters do not implement it.
+type SQLDBProvider interface {
+	// SQLDB returns the current underlying *sql.DB. After an adapter reconnects it
+	// returns the new handle, so do not cache it across reconnects.
+	SQLDB() *sql.DB
+}
+
 // SelectQuery interface for building SELECT queries (compatible with both GORM and Bun)
 type SelectQuery interface {
 	Model(model interface{}) SelectQuery