feat: production hardening — JWT security, WAL reader, tracing, 2PC real RPC, stress test fix

- JWT: getEffectiveJwtSecret() helper + warning log when not configured
- WAL: readEntries() with timestamp filter for PITR
- Tracing: core/tracing.nim with span recording + executeQuery integration
- 2PC: real TCP RPC via sendDistTxnRpc (host='' = local fallback)
- Stress test: updated comment, 10K ops confirmed with internal locks
- SSTable metadata comments clarified (offsets patched correctly)
- addParticipant has default params (host='', port=0)

src/barabadb/query/executor.nim

@@ -18,6 +18,7 @@ import ../protocol/wire
 import ../storage/lsm
 import ../storage/btree
 import ../core/mvcc
+import ../core/tracing
 
 type
   IndexEntry* = ref object
@@ -1495,6 +1496,15 @@ proc executeQuery*(ctx: ExecutionContext, astNode: Node, params: seq[WireValue]
     boundAst = bindParams(astNode, params)
 
   let stmt = boundAst.stmts[0]
+  let spanName = case stmt.kind
+    of nkSelect: "SELECT"
+    of nkInsert: "INSERT"
+    of nkUpdate: "UPDATE"
+    of nkDelete: "DELETE"
+    else: $stmt.kind
+  let span = defaultTracer.beginSpan(spanName)
+  defer: defaultTracer.endSpan(span)
+
   case stmt.kind
   of nkSelect:
     defer: