fix: production database guardrails against lock pile-ups and unsafe SQL - #130

A confirmed Editor ALTER TABLE ... MODIFY ... NOT NULL on a production MySQL
primary queued every write on the table for 240s. MySQL's default
lock_wait_timeout is one year, so the Editor's client timeout was the only
thing that stopped it.

Applies to every role, admins included:
- Pool-level lock guards (MySQL lock_wait_timeout/innodb_lock_wait_timeout=5,
  Postgres lock_timeout=5s) via Hikari connectionInitSql, re-applied by the
  executor after user SET preambles together with sql_safe_updates=1 and
  max_execution_time (30s on a writable server, client timeout on a replica).
  Fails closed if the guards cannot be applied.
- MySQL ALTER runs online only: ALGORITHM=INSTANT, falling back to INPLACE,
  LOCK=NONE; COPY/DEFAULT/SHARED/EXCLUSIVE refused before confirmation.
- New EXECUTE_DDL permission (ADMIN by default) for any mutation that is not
  row-only DML (DDL, CALL, SELECT INTO), also required by Index Advisor APPLY.
- Administrative statements blocked (GRANT, user/role DDL, KILL, LOCK TABLES,
  FLUSH, replication control, SET GLOBAL/PERSIST, sql_log_bin). SET GLOBAL
  previously ran as a "session preamble" for read-only roles too.
- MySQL executable comments (/*! */) and optimizer hints (/*+ */) refused:
  MySQL ran their body while every check saw an empty, read-only statement.
- TRUNCATE blocked in the Editor; 10k server-side row cap for user-facing
  origins; actor tag comment on every statement; audit retention 90 days.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…e comments

- Refuse MariaDB /*M! ... */ executable comments alongside MySQL /*! */ and
  /*+ */ hints (case-insensitive).
- A mutation counts as row-only DML only when both its queryType and its real
  leading verb are row-only (or WITH). The keyword-fallback queryType sanitizes
  a prefix and can disagree with what the database runs; DO and Postgres
  EXPLAIN ANALYZE CREATE TABLE ... AS now require EXECUTE_DDL.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

- Reset session guards to the pool baseline after every run (finally), so a
  per-run max_execution_time, sql_safe_updates or a user's SET no longer leaks
  to the next borrower, background jobs included.
- Apply the guards before preambles as well as after, and tag preambles, so a
  heavy SELECT placed first in a read-only batch is still bounded.
- Omit max_execution_time on MariaDB (served by the MySQL provider), where the
  fail-closed SET refused every query.
- Postgres CREATE/DROP INDEX CONCURRENTLY runs with lock_timeout = 0, so it is
  not cut off midway leaving an INVALID index.
- Fall back from INSTANT on servers that reject it as a syntax error (MySQL
  5.7, Aurora MySQL 2); refuse partition ALTERs without an explicit clause.
- Server-side row cap via setMaxRows only; LIMIT text is appended only when the
  client asked for a limit (FETCH FIRST / FOR UPDATE broke).
- Data-modifying CTEs stay row-only DML; clearer read time-limit message.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Security:
- Block Postgres role/identity switches (SET SESSION|LOCAL ROLE, SET SESSION
  AUTHORIZATION, SET role = ..., session_replication_role).
- Run the dangerous-function denylist on every surface; it only ran for MCP
  and dashboards, so the Editor ran dblink_exec / pg_read_file as plain reads.
  Add pg_terminate_backend and pg_cancel_backend (Java and MCP JS lists).
- Make McpSqlGuardService comment stripping linear: its lazy block-comment
  regex was quadratic on an unterminated /* (minutes of CPU per request on
  the MCP and public dashboard query paths). Same fix for the MySQL ALTER
  clause tokenizer, which now also ignores clauses inside comments.

Correctness:
- Postgres CONCURRENTLY index builds run with lock_timeout = 0 on every path
  via QueryExecutionProvider.ddlSessionSql (no INVALID indexes; no
  dialect SQL in IndexRecommendationApplyService).
- Broader reset after each run: Postgres RESET ALL; MySQL also restores
  sql_mode, foreign_key_checks, unique_checks, time_zone.
- Aurora readers detected via innodb_read_only.
- Row cap: 10k default, explicit requests up to 100k (CSV export).
- INTERNAL/SCHEDULED runs keep the pool baseline only.

Co-Authored-By: Claude Opus 5.5 <[email protected]>