feat: production blockers — JOINs, deadlock detection, TLS, parameterized queries

- JOIN execution: INNER/LEFT/RIGHT/FULL/CROSS with column disambiguation
- Deadlock detection: wait-for graph wired into TxnManager.write()
- TLS/SSL: OpenSSL via std/net for TCP wire protocol, auto self-signed certs
- Parameterized queries: ? placeholders with WireValue binding
- Wire protocol: mkQueryParams message support
- HTTP /query endpoint accepts JSON params array
- Nim client: query(sql, params) overload
- Tests: 262 passing (15 new)

All PLAN.md production blockers resolved.

src/barabadb/query/ir.nim

@@ -49,6 +49,7 @@ type
     irekCast
     irekConditional
     irekExists
+    irekStar
 
   IRJoinKind* = enum
     irjkInner
@@ -163,6 +164,8 @@ type
       elseExpr*: IRExpr
     of irekExists:
       existsSubquery*: IRPlan
+    of irekStar:
+      discard
 
 type
   TypeChecker* = ref object
@@ -240,3 +243,5 @@ proc inferExpr*(tc: TypeChecker, expr: IRExpr, context: Table[string, IRType]):
     return thenType
   of irekExists:
     return IRType(name: "bool", kind: itkScalar)
+  of irekStar:
+    return IRType(name: "star", kind: itkScalar)