feat(security): replace all inline sql with postgresql stored procedures

adds 91 typed stored procedures (migration 005) and routes all database operations through db.call(), eliminating inline sql from every plugin, middleware, and core module. parameters are strongly typed at the postgresql function level providing server-side validation as a defence-in-depth layer against sql injection on top of the existing client-side escaping

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>