fix: audit batches 3–4 — TLS verify, WS, OFFSET, B-tree, NULL equality

Close the remaining 2026-08 findings: peer TLS on leader forward, disttxn
SO_ERROR, compaction catalog order, OFFSET without LIMIT, window aggregates,
WebSocket mask/size/auth, SCRAM timing and cbind, B-tree leaf left-max
separators, and SQL three-valued NULL comparisons.

src/barabadb/query/exec/plan_exec.nim

@@ -255,12 +255,18 @@ proc executePlan*(ctx: ExecutionContext, plan: IRPlan): seq[Row] =
   of irpkLimit:
     let sourceRows = executePlan(ctx, plan.limitSource)
     var start = int(plan.limitOffset)
+    if start < 0: start = 0
     if start > sourceRows.len: start = sourceRows.len
+    if plan.limitCount < 0:
+      # OFFSET without LIMIT — return the remainder.
+      return sourceRows[start ..< sourceRows.len]
     if plan.limitCount == 0:
       return @[]
     var endIdx = start + int(plan.limitCount)
     if endIdx > sourceRows.len:
       endIdx = sourceRows.len
+    if endIdx < start:
+      endIdx = start
     return sourceRows[start..<endIdx]
 
   of irpkGroupBy: