feat(security): auth-gate cluster routes, enforce GRANT/REVOKE, cap decompression, redact credentials

[austin-barrington]

• Gate /internal/replicate and raft cluster routes behind auth middleware ([CRITICAL] Raft/cluster routes mounted outside auth — unauthenticated cluster takeover #92, [HIGH] /internal/replicate disables body limit — unauthenticated memory exhaustion #95)
• Enforce per-database GRANT/REVOKE for non-admin users (V1 [SEC] GRANT/REVOKE are no-ops — false sense of security #72, V1 [SEC] Per-database authorization check is vestigial — no actual enforcement #77)
• Cap gzip decompressed body size to prevent decompression bombs ([HIGH] gzip decompression bomb on /write — no decompressed-size cap #93)
• Require auth on statement summary endpoint, redact passwords in ring buffer (V1 [SEC] Statement summary endpoint is unauthenticated #75, V1 [SEC] Passwords exposed in statement summary ring buffer #76)
• Replace hand-rolled base64 decoder with base64 crate ([LOW] Security hardening — miscellaneous low-severity findings #96)
• Validate IPC segment lengths in WAL decode to prevent OOM
• Escape backslashes in backtick-quoted identifiers
• Add configurable replicate body limit with auto-resolution
• Add security integration tests for auth gating and privilege enforcement
• Update authentication, configuration, and replication docs