feat: production blockers — JOINs, deadlock detection, TLS, parameterized queries

- JOIN execution: INNER/LEFT/RIGHT/FULL/CROSS with column disambiguation
- Deadlock detection: wait-for graph wired into TxnManager.write()
- TLS/SSL: OpenSSL via std/net for TCP wire protocol, auto self-signed certs
- Parameterized queries: ? placeholders with WireValue binding
- Wire protocol: mkQueryParams message support
- HTTP /query endpoint accepts JSON params array
- Nim client: query(sql, params) overload
- Tests: 262 passing (15 new)

All PLAN.md production blockers resolved.

ROADMAP.md

@@ -158,7 +158,6 @@
 - [x] Nim client library (standalone nimble package — async/sync, query builder)
 - [x] Python client library (clients/python/baradb.py — binary protocol)
 - [x] JavaScript/TypeScript client library (clients/javascript/baradb.js)
-- [x] Go client library (clients/go/)
 - [x] Rust client library (clients/rust/)
 - [x] Import/Export (JSON, CSV, NDJSON)