fix: harden security and improve performance across the codebase

[johnny-emp]

Summary

• Security: Prevent path traversal in checkpoint storage, fix SQL injection in vector_init(), replace raw SQL filter in knn_filtered() with structured VectorFilter API, add extension path validation
• Performance: Migrate std::sync::Mutex to parking_lot::Mutex in hot paths (file-log, sqlite, lmdb), remove unused memmap2 dependency
• Robustness: Add MAX_DECLARED_KEYS (10,000) limit to guard against DoS via excessive key declarations, eliminate 50+ .lock().unwrap() calls

Changes

Security (High/Medium priority)

Fix	Location	Risk
Path traversal in checkpoint LocalStorage	checkpoint.rs	High
SQL injection in vector_init()	extension.rs	Medium
Raw SQL filter replaced with VectorFilter	search.rs	Medium
Extension path .. / symlink rejection	extension.rs	Low

Performance

Change	Location
std::sync::Mutex → parking_lot::Mutex	azoth-file-log, azoth-sqlite, azoth-lmdb
Remove .lock().unwrap() (50+ sites)	All crates using projection/event-log mutexes
Remove unused memmap2 dependency	azoth-file-log, workspace root

Robustness

Change	Location
MAX_DECLARED_KEYS = 10,000 enforced in all execute paths	transaction.rs

Test plan

• cargo check --workspace passes
• cargo test --workspace passes (240+ tests, 0 failures)
• Verify checkpoint path traversal rejection with crafted ids
• Verify VectorFilter produces correct SQL in integration tests
• Verify vector_init rejects injection payloads