feat: add database module and harden registry

[im10furry]

Summary

• Add a new database registry module with database/sql open helpers, dynamic pool profiles, transaction helpers, and safe query-fragment builders.
• Register the module across registry metadata, docs, AGENTS guidance, README files, VitePress navigation, and the embedded bundle.
• Harden existing modules:
  • reject oversized JSON bodies in auth and crud even when the prefix is valid JSON
  • disable arbitrary CRUD filters by default and cap/validate allowed filters
  • make middleware.ClientIP ignore spoofable forwarded headers by default
  • add RBAC capacity limits for roles, users, parents, and permissions
  • add bounded LRU eviction to file-upload in-memory storage
• Keep stdlib-only constraints intact; no new external dependencies were added.

Validation

• go run ./internal/cmd/build-bundle
• all registry modules: go test -count=1 ./...
• all registry modules: go vet ./...
• root packages: go test -count=1 ./cmd/... ./internal/...
• root packages: go vet ./cmd/... ./internal/...
• go run ./cmd/scion doctor --strict
• cd docs && npm run build
• git diff --check