feat(proxy): accept inbound EQL ciphertext payloads

[freshtonic]

Summary

• accept EQL v3 storage payloads and query-only operands in SQL literals and bind parameters before plaintext decoding
• validate payload version, inferred destination, configured scalar and SteVec SEM terms, and authenticated descriptors
• authenticate every stored ciphertext, including every SteVec entry, then independently rederive and compare its query projection
• accept bare selector hashes using the fixed selector-hash shape; document the unavoidable plaintext/hash ambiguity
• forward valid payloads without re-encryption and fail closed with a generic, documented transaction-aborting error
• cover application-generated payloads, query-only operands, selector hashes, metadata and term tampering, non-root SteVec tampering, and transaction recovery in cipherstash-proxy-integration
• demonstrate storage, query-only, and selector-hash inputs in the executable showcase

Compatibility

On encrypted columns, JSON values with top-level v, i, and at least one of c, h, or sv advertise themselves as EQL payloads and fail closed if invalid. There is no opt-out. The error documentation includes an upgrade audit query and guidance for text-backed source data.

Testing

• mise run test:check
• mise run test:unit (all 372 tests pass; the macOS configuration-store test required an unsandboxed isolated rerun)
• mise run test:clippy
• mise run test:format
• cargo test -p cipherstash-proxy-integration --no-run
• cargo test -p showcase --no-run

Runtime integration and showcase cases use the existing credentialed CI tasks; this checkout has no application/ZeroKMS credentials for starting an isolated current-branch Proxy locally.

Linear: CIP-3822

[tobyhede]

Reviewed the new inbound EQL ciphertext path. One security issue with two exploit paths, one design trade-off to confirm, and one operational gap. Each item was checked against the actual code on this branch and the cipherstash-client 0.42.2 dependency source before being posted here. Two items from an earlier automated pass did not hold up under verification and are not included: the "h" top-level key check is not dead code (it detects SteVec payloads, which carry no top-level c field), and the binary-parameter byte handling in bind.rs does not corrupt data (original bytes stay untouched, and a failed trial parse falls back safely).

See inline comments for details.