fix(security): preserve credential integrity across auth lifecycle - #178

Summary

• keep Trust-mode pgwire identities connection-local instead of creating durable credentials
• reject empty passwords and password assignment to service accounts across local and replicated credential APIs
• reject persisted regular-user credentials derived from an empty password while preserving intentional passwordless service accounts
• preserve and revalidate Trust identity across prepared queries and session resets
• split the pgwire factory into focused modules while preserving its public API

Validation

• focused credential-store security coverage passes
• focused pgwire authentication, tenant-scoping, user, and grant coverage passes
• workspace Clippy passes with all targets, all features, and warnings denied
• formatting and diff hygiene checks pass