fix: stabilization session — auth bypass, raft quorum, wire DoS, query operators

Security:
- MIGRATE handler now requires auth (unauthenticated arbitrary writes)
- parseHeader rejects oversized messages before allocation (pre-auth DoS)

Correctness:
- raft commit uses strict majority (N div 2 + 1), fixing even-N minority commit
- power (**) and concat (++) no longer lowered to equality
- != is now the exact complement of = for numerically-equal values
- legacy REP payload carries explicit put/delete tag (PK-only rows survive)
- REP receiver maintains secondary indexes via applyReplicatedPut/Delete
- snapshot send runs gzip off the event loop (heartbeat stall mitigation)

Docs: PLAN.md (session 13), BUG_AUDIT_2026-08.md (~28 findings, 23 tracked),
known-limitations.md, CHANGELOG.md.

Verified: baradadb build clean; test_all + bugfix_test pass.

src/barabadb/query/exec/eval.nim

@@ -436,11 +436,12 @@ proc evalExprOld*(expr: IRExpr, row: Table[string, string], ctx: ExecutionContex
       except CatchableError: discard
       return "false"
     of irNeq:
-      if left != right: return "true"
-      # Try numeric comparison
+      # Numeric-first so `!=` is the exact complement of `=` (irEq): string
+      # inequality alone would make `5 != 5.0` true while `5 = 5.0` is true.
       try:
         return if parseFloat(left) != parseFloat(right): "true" else: "false"
-      except CatchableError: return "false"
+      except CatchableError:
+        return if left != right: "true" else: "false"
     of irLt:
       try:
         return if parseFloat(left) < parseFloat(right): "true" else: "false"

src/barabadb/query/exec/lower.nim

@@ -76,6 +76,8 @@ proc lowerExpr*(node: Node): IRExpr =
     of bkJsonContainedBy: irOp = irJsonContainedBy
     of bkJsonHasAny: irOp = irJsonHasAny
     of bkJsonHasAll: irOp = irJsonHasAll
+    of bkPow: irOp = irPow
+    of bkConcat: irOp = irAdd  # irAdd concatenates string operands
     else: irOp = irEq
     result.binOp = irOp
     result.binLeft = lowerExpr(node.binLeft)