fix: audit batches 3–4 — TLS verify, WS, OFFSET, B-tree, NULL equality

Close the remaining 2026-08 findings: peer TLS on leader forward, disttxn
SO_ERROR, compaction catalog order, OFFSET without LIMIT, window aggregates,
WebSocket mask/size/auth, SCRAM timing and cbind, B-tree leaf left-max
separators, and SQL three-valued NULL comparisons.

tests/test_all.nim

@@ -4298,6 +4298,21 @@ suite "Window Functions":
       if row["name"] == "Bob":
         check row["last_sal"] == "90000"
 
+  test "SUM/AVG/COUNT window aggregates over a running frame":
+    ## Default frame is UNBOUNDED PRECEDING .. CURRENT ROW (lower.nim).
+    let r = qexec.executeQuery(ctx, parse(
+      "SELECT name, salary, SUM(salary) OVER (ORDER BY salary) AS running, COUNT(*) OVER (ORDER BY salary) AS cnt FROM employees"))
+    check r.success
+    check r.rows.len == 5
+    for row in r.rows:
+      if row["name"] == "Charlie":
+        check parseFloat($row["running"]) == 70000.0
+        check $row["cnt"] == "1"
+      if row["name"] == "Eve":
+        # 70000+75000+80000+90000+95000
+        check parseFloat($row["running"]) == 410000.0
+        check $row["cnt"] == "5"
+
 suite "GROUP BY Aggregates":
   var db: LSMTree
   var ctx: qexec.ExecutionContext