refactor(security): move all database access into pkg/security/lookup

pkg/security no longer contains SQL. Every provider calls a store interface
from lookup, implemented by a procedure backend (Postgres stored procedures,
the default there) and a direct backend (dialect-driven SQL for postgres,
sqlite, mysql and mssql with configurable table and column names).

- add sectypes, lookup, lookup/{dialect,procedure,direct,backends,ddl,conformance}
- split totp and providers sub packages out of the core package
- replace SQLNames/TableNames/QueryMode with lookup.Config (see breaking_changes.md)
- direct backend now covers column/row security and API-key login
- move txsettings SQL to lookup.ApplyTxSettings; remove password.go
- move schema scripts under lookup/, add reference DDL per dialect
- add a shared conformance suite; run it on sqlite, and on Postgres in a
  podman/docker container (RESOLVESPEC_TEST_CONTAINERS=1)
- fix procedure schema bugs found on real Postgres: duplicate p_data
  parameter, JSON null arrays, expires_at timezone casts, passkey list
  GROUP BY, missing resolvespec_passkey_login; accept zone-less timestamps

pkg/security/txsettings_test.go

@@ -3,7 +3,6 @@ package security
 import (
 	"context"
 	"errors"
-	"strings"
 	"testing"
 
 	"github.com/DATA-DOG/go-sqlmock"
@@ -22,76 +21,6 @@ func txSettingsDB(t *testing.T) (common.Database, sqlmock.Sqlmock) {
 	return database.NewPgSQLAdapter(db), mock
 }
 
-func TestApplyTxSettingsStampsInNameOrderOnTx(t *testing.T) {
-	pool, mock := txSettingsDB(t)
-	sc := &mockSecurityContext{ctx: context.Background()}
-
-	mock.ExpectBegin()
-	mock.ExpectExec(`set_config\('app\.tenant', .*decode\('`).WillReturnResult(sqlmock.NewResult(0, 0))
-	mock.ExpectExec(`set_config\('app\.user_id', .*decode\('`).WillReturnResult(sqlmock.NewResult(0, 0))
-	mock.ExpectCommit()
-
-	err := pool.RunInTransaction(context.Background(), func(tx common.Database) error {
-		return ApplyTxSettings(sc, tx, map[string]string{"app.user_id": "7", "app.tenant": "o'x?"})
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Fatal(err)
-	}
-}
-
-func TestApplyTxSettingsValueIsNeverInlined(t *testing.T) {
-	pool, mock := txSettingsDB(t)
-	sc := &mockSecurityContext{ctx: context.Background()}
-	var seen string
-	mock.ExpectBegin()
-	mock.ExpectExec(`set_config`).WillReturnResult(sqlmock.NewResult(0, 0))
-	mock.ExpectCommit()
-	_ = pool.RunInTransaction(context.Background(), func(tx common.Database) error {
-		// Capture via a wrapper so the raw statement can be inspected.
-		return ApplyTxSettings(sc, &queryRecorder{Database: tx, got: &seen}, map[string]string{"app.v": "'; DROP TABLE x; --?"})
-	})
-	if strings.Contains(seen, "DROP") || strings.Contains(seen, "?") {
-		t.Fatalf("value leaked into SQL text: %s", seen)
-	}
-}
-
-type queryRecorder struct {
-	common.Database
-	got *string
-}
-
-func (q *queryRecorder) Exec(ctx context.Context, query string, args ...interface{}) (common.Result, error) {
-	*q.got = query
-	return q.Database.Exec(ctx, query, args...)
-}
-
-func TestApplyTxSettingsRejectsBadNameAndDriver(t *testing.T) {
-	pool, _ := txSettingsDB(t)
-	sc := &mockSecurityContext{ctx: context.Background()}
-
-	for _, name := range []string{"user_id", "app.x'); DROP", "app..x", "app.x y"} {
-		if err := ApplyTxSettings(sc, pool, map[string]string{name: "1"}); err == nil {
-			t.Fatalf("name %q must be rejected", name)
-		}
-	}
-	if err := ApplyTxSettings(sc, pool, nil); err != nil {
-		t.Fatalf("empty settings must be a no-op: %v", err)
-	}
-	if err := ApplyTxSettings(sc, &driverStub{Database: pool, name: "sqlite"}, map[string]string{"app.x": "1"}); err == nil {
-		t.Fatal("non-postgres driver must fail closed")
-	}
-}
-
-type driverStub struct {
-	common.Database
-	name string
-}
-
-func (d *driverStub) DriverName() string { return d.name }
-
 func TestStampTxSettingsUsesConfiguredFunc(t *testing.T) {
 	pool, mock := txSettingsDB(t)
 	sc := &mockSecurityContext{ctx: context.Background()}