refactor(db): extract domain stores from database runtime

[TheSentinel454]

Summary

Finish the remaining database-store extraction tracked by TheSentinel454/buzz#2 in one reviewable PR.

This consolidates the previously stacked, patch-equivalent domain slices after #6782 merged. It preserves the runtime/store boundary established by #6660, #6668, #6700, and #6782 while separating database runtime infrastructure from domain-owned persistence:

• runtime/ owns pool construction and sizing, writer/reader routing, read sessions and route proofs, transaction infrastructure, observability primitives, replica fencing, health support, migrations, and cross-cutting runtime tests.
• store/ owns domain records, SQL, row parsing, locks and invariants, Db domain methods, focused tests, and logical-operation datastore spans.
• lib.rs remains a 56-line compatibility facade that preserves existing crate-root paths and Db method signatures through re-exports.

Domain coverage includes API tokens, authentication allowlists, reminders, event queries, threads, reactions, feeds, users and DMs, push, workflows/runs/approvals, relay membership and invites, product feedback, moderation/admin moderation, git repositories, archived identities, usage, partition maintenance, deletion, channel membership inherited from merged #6782, and the final runtime/store layout.

The cumulative branch is patch-equivalent to the 24 remaining reviewed stack commits. The only integration-only change is updating two compile-time fixture paths after moving migration.rs under runtime/.

Exact base and head

• Base: main at e76c81968b65b0755b83efdd59dc3375c59ddf40 (merged refactor(db): split channel membership store #6782)
• Head: codex/issue-2-store-extraction at cc14bc9d81ded60c30ec64c84234d37c9278b572

Related issue

• Structural tracker: TheSentinel454/buzz#2
• Domain trackers: #6, #7, #12, #13
• Acceptance trackers: #17, #19

This supersedes #6783, #6784, #6787, #6788, #6789, #6792, #6820, #6794, #6796, #6797, #6798, #6799, #6804, #6805, #6806, #6808, #6809, #6811, #6812, #6813, #6814, #6815, and #6890. Their discussions remain available for review history.

#17 / #19 acceptance

• Preserves the metric names, fixed labels, transaction/lock timing boundaries, and privacy/cardinality constraints introduced by Add database pressure observability #6700.
• Keeps exactly one datastore span per public logical operation. has_admin_or_owner receives the one previously missing wrapper span; its pool-level helper remains uninstrumented, so there is no nested duplicate.
• Removes store_ownership.rs; physical ownership and focused source guards now enforce the boundary directly.
• Leaves no impl Db, domain SQL, focused domain test group, or datastore span in lib.rs.
• Preserves existing public paths such as buzz_db::channel, buzz_db::event, and buzz_db::workflow through crate-root re-exports while keeping internal runtime and store namespaces private.

Non-goals

• No SQL, schema, locking, transaction, retry, timeout, or client-visible behavior changes.
• No generic store traits, domain handles, broad PgExecutor migration, new store crate, raw pool accessor, or broader directory reorganization.
• No tracker issues are closed by this PR.

Risk

The cumulative diff is large but structural. Risk is primarily module-path or ownership drift; it is mitigated by patch-equivalence checks against the prior reviewed commits, preserved public re-exports, source guards, touched-crate compilation, full moved PostgreSQL test coverage, and an independent exact-head review on a separate clean Blox workstation.

Testing

Author workstation buzz-tornquist-issue-2-consolidate, exact head cc14bc9d81ded60c30ec64c84234d37c9278b572:

• cargo fmt --all --check
• cargo clippy -p buzz-db -p buzz-relay --all-targets -- -D warnings
• cargo test -p buzz-db --lib — 112 passed, 200 PostgreSQL tests intentionally ignored
• cargo test -p buzz-db --lib -- --ignored --test-threads=1 — 195 passed in the shared serial run; the five shared-state/config-sensitive tests all passed as exact reruns against fresh databases with their required bootstrap mode
• cargo test -p buzz-db --test observability_source — 1 passed
• cargo test -p buzz-relay --lib --no-run
• cargo test -p buzz-relay --lib -- --test-threads=1 with native PostgreSQL/Redis and the reconciled schema — 922 passed, 49 infrastructure-marked tests ignored
• git diff --check
• Source guards: lib.rs is 56 lines; zero impl Db; zero datastore spans; no store_ownership.rs; no external references to private buzz_db::runtime or buzz_db::store paths
• Datastore-span multiset comparison: all existing names preserved, with only the single required has_admin_or_owner wrapper added
• Range-diff: all 24 remaining historical slice commits are patch-equivalent after rebasing onto merged refactor(db): split channel membership store #6782

Independent clean review workstation buzz-tornquist-issue-2-consolidated-review, detached at exact head cc14bc9d81ded60c30ec64c84234d37c9278b572:

• cargo fmt --all --check
• cargo clippy -p buzz-db -p buzz-relay --all-targets -- -D warnings
• cargo test -p buzz-db --lib — 112 passed, 200 ignored
• cargo test -p buzz-db --test observability_source — 1 passed
• cargo test -p buzz-relay --lib --no-run
• Cumulative ownership/re-export/instrumentation review — no actionable findings

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is e76c81968b65b0755b83efdd59dc3375c59ddf40...cc14bc9d81ded60c30ec64c84234d37c9278b572.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review cc14bc9d81ded60c30ec64c84234d37c9278b572 to authorize a new review.
Any previous review applies only to its recorded range.