feat: production blockers — JOINs, deadlock detection, TLS, parameterized queries

- JOIN execution: INNER/LEFT/RIGHT/FULL/CROSS with column disambiguation
- Deadlock detection: wait-for graph wired into TxnManager.write()
- TLS/SSL: OpenSSL via std/net for TCP wire protocol, auto self-signed certs
- Parameterized queries: ? placeholders with WireValue binding
- Wire protocol: mkQueryParams message support
- HTTP /query endpoint accepts JSON params array
- Nim client: query(sql, params) overload
- Tests: 262 passing (15 new)

All PLAN.md production blockers resolved.

src/baradadb.nim

@@ -3,9 +3,11 @@
 import std/asyncdispatch
 import std/threadpool
 import std/locks
+import std/os
 import barabadb/core/server
 import barabadb/core/httpserver
 import barabadb/core/config
+import barabadb/protocol/ssl
 import barabadb/storage/lsm
 import barabadb/storage/compaction
 
@@ -57,9 +59,24 @@ proc runTcpServer(config: BaraConfig) {.async.} =
   await server.run()
 
 proc main() =
-  let config = loadConfig()
+  var config = loadConfig()
   echo "BaraDB v0.1.0 — Multimodal Database Engine"
 
+  if config.tlsEnabled:
+    if config.certFile.len == 0 or config.keyFile.len == 0 or
+       not fileExists(config.certFile) or not fileExists(config.keyFile):
+      echo "TLS enabled but no certificate found. Generating self-signed certificate..."
+      let (cert, key) = generateSelfSignedCert(config.dataDir / "certs")
+      if cert.len > 0 and key.len > 0:
+        config.certFile = cert
+        config.keyFile = key
+        echo "Generated self-signed certificate:"
+        echo "  Cert: ", cert
+        echo "  Key:  ", key
+      else:
+        echo "WARNING: Failed to generate self-signed certificate. TLS disabled."
+        config.tlsEnabled = false
+
   # Start HTTP server (blocking, multi-threaded via hunos) in background thread
   var httpServer = newHttpServer(config)
   spawn httpServer.run(config.port + 440)  # HTTP port = TCP port + 440