fix(sqlite): add an optimistic local commit protocol

[marcus-pousette]

Problem

SQLite authorization is asynchronous. Holding a savepoint while application auth runs can let unrelated same-connection work enter that savepoint and be rolled back by an auth rejection.

What changes

The native local-write functions expose two paths:

1. Immediate commit for unauthenticated writes.
2. Read-only prepare followed by a short optimistic commit for authenticated writes.

Prepare returns the exact proposal and a token bound to the document, clean materialization revision, and complete operation body. Commit takes the writer lock, rebuilds the operation, and returns an explicit conflict if state changed or the lock is busy.

The native layer rejects optimistic use inside a caller-owned transaction and rolls back every post-savepoint failure.

Fast paths

• Unauthenticated writes remain one direct SQL/UDF call.
• No transaction or lock is held while authorization runs.
• Hashing, retries, and the extra SQL round trip exist only on the authenticated path.

Tests

• prepare is read-only
• fresh prepare commits the exact proposal
• stale revision and WAL contention return conflicts
• caller-owned transactions are rejected
• rollback failures do not leak transaction state
• immediate writes retain the direct path

Stack

Stacked on #192. #194 adds the mandatory proof-bearing commit and #195 adds the TypeScript retry bridge.