refactor(security): move all database access into pkg/security/lookup

pkg/security no longer contains SQL. Every provider calls a store interface
from lookup, implemented by a procedure backend (Postgres stored procedures,
the default there) and a direct backend (dialect-driven SQL for postgres,
sqlite, mysql and mssql with configurable table and column names).

- add sectypes, lookup, lookup/{dialect,procedure,direct,backends,ddl,conformance}
- split totp and providers sub packages out of the core package
- replace SQLNames/TableNames/QueryMode with lookup.Config (see breaking_changes.md)
- direct backend now covers column/row security and API-key login
- move txsettings SQL to lookup.ApplyTxSettings; remove password.go
- move schema scripts under lookup/, add reference DDL per dialect
- add a shared conformance suite; run it on sqlite, and on Postgres in a
  podman/docker container (RESOLVESPEC_TEST_CONTAINERS=1)
- fix procedure schema bugs found on real Postgres: duplicate p_data
  parameter, JSON null arrays, expires_at timezone casts, passkey list
  GROUP BY, missing resolvespec_passkey_login; accept zone-less timestamps

pkg/security/providers/policy_config.go

@@ -0,0 +1,61 @@
+package providers
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/bitechdev/ResolveSpec/pkg/security/sectypes"
+)
+
+// ConfigColumnSecurityProvider provides static column security configuration
+type ConfigColumnSecurityProvider struct {
+	rules map[string][]sectypes.ColumnSecurity
+}
+
+func NewConfigColumnSecurityProvider(rules map[string][]sectypes.ColumnSecurity) *ConfigColumnSecurityProvider {
+	return &ConfigColumnSecurityProvider{rules: rules}
+}
+
+func (p *ConfigColumnSecurityProvider) GetColumnSecurity(ctx context.Context, userID int, schema, table string) ([]sectypes.ColumnSecurity, error) {
+	key := fmt.Sprintf("%s.%s", schema, table)
+	rules, ok := p.rules[key]
+	if !ok {
+		return []sectypes.ColumnSecurity{}, nil
+	}
+	return rules, nil
+}
+
+// ConfigRowSecurityProvider provides static row security configuration
+type ConfigRowSecurityProvider struct {
+	templates map[string]string
+	blocked   map[string]bool
+}
+
+func NewConfigRowSecurityProvider(templates map[string]string, blocked map[string]bool) *ConfigRowSecurityProvider {
+	return &ConfigRowSecurityProvider{
+		templates: templates,
+		blocked:   blocked,
+	}
+}
+
+func (p *ConfigRowSecurityProvider) GetRowSecurity(ctx context.Context, userRef any, schema, table string) (sectypes.RowSecurity, error) {
+	key := fmt.Sprintf("%s.%s", schema, table)
+
+	if p.blocked[key] {
+		return sectypes.RowSecurity{
+			Schema:    schema,
+			Tablename: table,
+			UserID:    userRef,
+			HasBlock:  true,
+		}, nil
+	}
+
+	template := p.templates[key]
+	return sectypes.RowSecurity{
+		Schema:    schema,
+		Tablename: table,
+		UserID:    userRef,
+		Template:  template,
+		HasBlock:  false,
+	}, nil
+}