Default to rustls and enable couchdb backend by default

[SeriousBug]

Summary

• Switch the default TLS implementation for backend-sqlite, backend-couchdb, and backend-redis to rustls, so a stock build no longer needs a system OpenSSL / libssl-dev.
• Enable backend-couchdb in the default feature set (pure Rust now that it uses rustls; negligible binary-size cost).
• Leave backend-dynamodb opt-in. Enabling it pulls in the AWS SDK (DynamoDB + STS/SSO credential SDKs) and adds ~13 MB to a stripped release binary, which is too much to enable for everyone by default. Documented this in the Readme.

Binary size check (release + stripped, examples/basic)

Backends enabled	Size
redis + in-memory + sqlite + couchdb	9.25 MB
above + dynamodb	22.30 MB

Measured with the default release profile (no LTO). With lto = "fat" the delta would likely shrink, but it's still a substantial dep, so opt-in is the safer default.

Notes / trade-offs

• The sqlite/couchdb/redis TLS switches only affect the underlying HTTP/TLS stack (sqlx runtime feature, reqwest TLS backend, redis tokio-tls comp). sqlite itself doesn't even use TLS — the feature just selects which TLS impl sqlx's tokio runtime links against.
• Users who want native-tls can still opt in explicitly via backend-sqlite-native-tls / backend-couchdb-native-tls. The Readme has been updated to reflect the new defaults.

Test plan

• cargo check with all default backends enabled
• cargo check with only redis + rustls comp
• cargo build --release size comparison with and without dynamodb
• CI passes