…ation

Add embedded analytical database service with columnar storage, per-space
isolation, and UCAN capability model. Mirrors the SQL service architecture
with DuckDB-specific features:

Core module (tinycloud-core/src/duckdb/):
- Actor-based connection pool with idle timeout and memory threshold promotion
- SQL parser validation (GenericDialect) as primary security layer
- DuckDB settings lockdown (external access disabled, unsigned extensions blocked)
- Rich value types including List and Struct with recursive serde
- Describe, Ingest, ExportToKv, Export, Import request variants
- UCAN caveats for table/column/statement allowlists and read-only mode

Server integration:
- DuckDbStorageConfig with configurable path, memory threshold, idle timeout
- Route handling with capability extraction and error status mapping
- Binary response support for database export and Arrow IPC streams
- "duckdb" added to /version features

Security:
- Replace statement blocklist with 3-tier allowlist (default/admin/delegation bypass)
- Block security-critical SET vars (enable_external_access, etc.) unconditionally
- Expand function blocklist (parquet_scan, csv_scan, glob, iceberg_scan, etc.)
- Validate max_memory against SQL injection
- Validate db_name against path traversal (.., /, \, null)
- Validate imported databases (temp file + DuckDB open + test query)
- Block export when caveats active
- Apply caveats to describe (filter tables/columns)
- Handle SELECT * with column caveats

Types:
- Fix ColumnInfo wire format (type/nullable instead of dataType/isNullable)
- Remove unnecessary Deserialize from DuckDbResponse
- Fix UBigInt truncation (values > i64::MAX as string)
- Fix Map key formatting (Display instead of Debug)

Robustness:
- Clean up stale actor entries from DashMap on exit
- Fix promote_to_file (temporarily enable external access for EXPORT DATABASE)
- Use async I/O (tokio::fs) in async functions
- Replace expect() with error propagation in actor open
- Replace filter_map(|r| r.ok()) with proper error propagation
- Add statement_timeout = 30s

Arrow IPC:
- Add execute_query_arrow() using stmt.query_arrow() + StreamWriter
- Route Arrow format via Accept header through to actor
- Add Arrow variant to DuckDbResponse

Quality:
- Extract verify_auth() and read_json_body() helpers from route handlers
- Add 32 unit tests across parser, caveats, storage, and types