refactor(db): extract domain stores from database runtime

[TheSentinel454]

Summary

Finish the remaining database-store extraction tracked by TheSentinel454/buzz#2 in one reviewable PR.

This consolidates the previously stacked domain slices after #6782 merged. It preserves the runtime/store boundary established by #6660, #6668, #6700, and #6782 while separating database runtime infrastructure from domain-owned persistence:

• runtime/ owns pool construction and sizing, writer/reader routing, read sessions and route proofs, transaction infrastructure, observability primitives, replica fencing, health support, migrations, and cross-cutting runtime tests.
• store/ owns domain records, SQL, row parsing, locks and invariants, Db domain methods, focused tests, and logical-operation datastore spans.
• lib.rs remains a 57-line compatibility facade that preserves existing crate-root paths and Db method signatures through re-exports.

Domain coverage includes API tokens, authentication allowlists, reminders, event queries, threads, reactions, feeds, users and DMs, push, workflows/runs/approvals, relay membership and invites, product feedback, moderation/admin moderation, relay admin actions/operators, git repositories, archived identities, usage, partition maintenance, deletion, channel membership inherited from merged #6782, and the final runtime/store layout.

The branch has been rebased onto current main. Database changes that landed there were incorporated rather than overwritten: relay_admin_actions.rs and relay_operators.rs now live under store/, their 27 public Db wrappers and existing behavior remain intact, and every wrapper has exactly one fixed-name datastore span. Concurrent changes to migration, moderation, admin moderation, and error handling are also retained.

Exact base and head

• Base: main at ed11c8d8bf0a17402be5cf243724f89471530d2f
• Head: codex/issue-2-store-extraction at be24430472d1a87ac5c0d6026c620cd6caea3537

Related issue

• Structural tracker: TheSentinel454/buzz#2
• Domain trackers: #6, #7, #12, #13
• Acceptance trackers: #17, #19

This supersedes #6783, #6784, #6787, #6788, #6789, #6792, #6820, #6794, #6796, #6797, #6798, #6799, #6804, #6805, #6806, #6808, #6809, #6811, #6812, #6813, #6814, #6815, and #6890. Their discussions remain available for review history.

#17 / #19 acceptance

• Preserves the metric names, fixed labels, transaction/lock timing boundaries, and privacy/cardinality constraints introduced by Add database pressure observability #6700.
• Keeps exactly one datastore span per public logical operation, including the 27 relay-admin wrappers added on main.
• Removes store_ownership.rs; physical ownership and focused source guards now enforce the boundary directly.
• Leaves no impl Db, domain SQL, focused domain test group, or datastore span in lib.rs.
• Preserves existing public paths such as buzz_db::channel, buzz_db::event, and buzz_db::workflow through crate-root re-exports while keeping internal runtime and store namespaces private.

Non-goals

• No SQL, schema, locking, transaction, retry, timeout, or client-visible behavior changes.
• No generic store traits, domain handles, broad PgExecutor migration, new store crate, raw pool accessor, or broader directory reorganization.
• No tracker issues are closed by this PR.

Risk

The cumulative diff is large but structural. Risk is primarily module-path, ownership, or conflict-resolution drift. It is mitigated by preserving public re-exports, comparing the newly moved main implementations to their upstream source, source guards, touched-crate compilation, PostgreSQL-backed test coverage, and an independent exact-head review on a separate clean Blox workstation.

Testing

Author workstation buzz-tornquist-pr-6987-rebase, rebased branch ending at exact head be24430472d1a87ac5c0d6026c620cd6caea3537:

• cargo fmt --all --check
• cargo clippy -p buzz-db -p buzz-relay --all-targets -- -D warnings
• cargo test -p buzz-db --lib — 113 passed, 240 PostgreSQL tests intentionally ignored
• cargo test -p buzz-db --test observability_source — 2 passed
• PostgreSQL-backed buzz-db coverage under native PostgreSQL — 235 passed in the shared serial run; the five shared-state/config-sensitive cases passed as isolated reruns against fresh schemas, including the two owner-limit tests with their fixture's BUZZ_MAX_COMMUNITIES_PER_OWNER=3
• cargo test -p buzz-relay --lib -- --test-threads=1 under native PostgreSQL/Redis — 991 passed; the three current-month partition-sensitive identity-archive cases passed after provisioning the August 2026 test partition; 87 infrastructure-marked tests remained ignored
• Source/diff guards — relay-admin implementation bodies match current main; all 27 public wrapper signatures are retained; exactly one datastore span wraps each wrapper; lib.rs has zero impl Db blocks and zero datastore spans; no duplicate top-level relay-admin modules or store_ownership.rs; error.rs matches current main

Independent clean review workstation buzz-tornquist-pr-6987-review, detached at exact head be24430472d1a87ac5c0d6026c620cd6caea3537:

• cargo fmt --all --check
• cargo clippy -p buzz-db -p buzz-relay --all-targets -- -D warnings
• cargo test -p buzz-db --lib — 113 passed, 240 ignored
• cargo test -p buzz-db --test observability_source — 2 passed
• Exact-head ownership/re-export/instrumentation audit — no remaining actionable findings

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is 2f66ee24a0bf5efa958378069a6b155e99a1d068...be24430472d1a87ac5c0d6026c620cd6caea3537.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review be24430472d1a87ac5c0d6026c620cd6caea3537 to authorize a new review.
Any previous review applies only to its recorded range.

[wpfleger96]

🤖 Approving after three independent passes at exact head be24430: a source-level review, a mechanical base-vs-head verification, and a live E2E matrix against an isolated relay + Postgres/Redis stack.

What was checked:

• All 256 public async Db methods and every previously-public crate-root module survive the 57-line lib.rs facade; the 318 external module references still resolve.
• SQL string extraction across the exact base..head range shows zero removed or changed production SQL — the only additions are test fixtures. No migration, schema, lock, transaction, retry, or timeout surface changed.
• Metrics call sites are byte-identical to base. Datastore spans: 222 → 250, nothing removed or renamed; the 28 additions are exactly the relay-admin/operator wrappers required by the observability contract, with no duplicate names, and the new source guard enforces one-span-per-wrapper.
• Relocated relay-admin/operator implementations match their pre-move main sources apart from module wiring.
• Live E2E at this head: channels, membership, messages, threads, reactions, DMs (create/hide/reopen), workflows incl. post-restart, moderation ban/unban with write gating and audit history, relay-member removal/re-add gating, v2 invite mint/claim/exhaustion, and full restart persistence — all passed, with direct Postgres checks confirming thread metadata and counters.

No blocking findings from any of the three passes.