harden: production-readiness pass (gold-standard audit)

[zvndev]

Implements the actionable findings from the gold-standard audit (43.5/50). Closes the real gaps without cargo-culting. Behavior-preserving for existing clients.

Server / security

• RBAC enforces the full permission lattice. Statements map to Read/Write/Ddl; readwrite now explicitly carries Ddl (app users create their own tables), so readwrite/admin keep full access, readonly stays read-only, any authenticated role may still read. Admin reserved for user management. Was previously a binary read/write gate with a defined-but-unenforced lattice. +tests.
• Resource-limit errors surface to remote clients. Sort/join/memory-budget errors (e.g. "…add a LIMIT clause") were masked to the generic query execution error by the wire sanitizer — same bug class as the unique-violation message fixed last release. Now allowlisted (leak no internal state). +tests.

Release / CI / supply chain

• Automated post-publish durability gate — scripts/smoke-release.sh: install → README PowQL flow → kill -9 → restart → assert WAL replay recovered every row + unique constraint still enforced. Wired as a required release.yml job. This is the exact gate whose absence yanked v0.4.1–0.4.3. Verified ALL-PASS locally.
• Real MSRV build job — compiles the workspace on the pinned 1.93 toolchain (the old job only grepped that the version string matched docs).
• cargo audit fixed — scoped-ignore the 3 postgres DoS advisories whose entire path is confined to the publish = false powdb-compare bench crate (.cargo/audit.toml + action ignore:, with provenance). No shipping crate affected; cargo audit now exits clean instead of failing the gate on dev-only noise.
• TS client version drift fixed — CLIENT_VERSION = src = dist = package.json (0.5.0); README points at npm so it can't restale; new CI job asserts package.json === CLIENT_VERSION.
• Dockerfile dep-cache now copies the auth/backup manifests it was silently missing (full dependency closure cached).

Build / hygiene

• panic = "abort" documented as a deliberate crash-only design (fast exit → supervised restart → WAL replay → consistent state — safer for a stateful engine than unwinding into a poisoned RwLock). Every deploy example confirmed under an auto-restart policy; requirement documented in examples/deploy/README.md. (The audit suggested removing abort; verifying against the actual lock model showed keeping it is the correct, safer call — see the Cargo.toml comment.)
• [workspace.lints] (clippy::all = deny) so cargo clippy fails locally with the same rules CI enforces. No new failures — mirrors the existing gate.
• Removed ~190 LOC dead mvcc.rs/tx.rs snapshot-isolation scaffolding shipping in powdb-storage; the live engine uses RwLock.
• Fixed stale powdb-auth "not wired in" doc-comments and a CLI --help example using a | pipe operator PowQL doesn't have.

Verification

cargo build/clippy/fmt clean · full workspace tests 0 failures · scripts/smoke-release.sh ALL-PASS · cargo audit clean · TS-version assert pass.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}