refactor(db): move feed store ownership

[TheSentinel454]

Why

Continue tracker #2 by moving home-feed persistence wrappers beside the feed SQL while preserving the parent runtime/read-routing boundary. This child stacks on #6792.

What

• Move all six feed-facing Db APIs and datastore spans into feed.rs: mentions, needs-action, and activity, each with direct and routed variants
• Preserve the BOUNDED-only replica predicate, connection-local reader session, writer fallback, route labels, SQL, visibility filters, and public signatures
• Keep route_read, RoutePredicate/RouteDecision, replica fence/session infrastructure, and the cross-domain routed tenant-confinement test in lib.rs
• Keep the feed builders, SQL entry points, row conversion, and focused PostgreSQL tests in feed.rs
• Add a feat: soft-delete for events/channels, enriched API responses, NIP-29 group management #17/Remove IF NOT EXISTS from migrations and drop mysql CLI fallback #19 source guard for unique wrapper/span ownership and the retained runtime test boundary

Stack

• Exact base: codex/issue-2-feed-roster-test-fixtures at f18b0d3 (#6820)
• Exact head: codex/issue-2-feed-store at 3062146
• Tracker: buzz-db: break up lib.rs — move impl Db methods to domain modules TheSentinel454/buzz#2
• Domain issue: none; this is a remaining feed-domain slice identified by the tracker ledger
• Test/span acceptance: buzz-db: move lib.rs tests (~4,000 lines) to domain modules TheSentinel454/buzz#17 and buzz-db: consistent #[datastore_span] tracing placement TheSentinel454/buzz#19

Non-goals

• No SQL, schema, routing, retry, timeout, visibility, result-limit, or client-visible behavior changes
• No movement of route/session/fence infrastructure or its cross-domain confinement tests out of lib.rs
• No fix to the pre-existing oversized kind-39002 test fixture rejected by the current roster validation trigger
• No store traits, domain-handle redesign, broad PgExecutor migration, raw pool accessor, new crate, or directory-wide reorganization
• No changes to, retargeting of, or merge action on parent PRs or PR Add database pressure observability #6700

Risk Assessment

Low. The six wrappers moved intact with module qualification only. Each routed path still uses RoutePredicate::Bounded, the same reader connection helper, identical route metric labels, and the same writer fallback. Three PostgreSQL query tests and the cross-domain routed confinement test cover tenant/visibility behavior; the ownership guard protects the runtime/store split and one-span rule.

Blox Verification

Author workstation: buzz-tornquist-issue-2-store-stack (2046520), exact head a3df858458d5cebb515ae1bc10135a165e5b4758.

• TDD ownership guard — failed before extraction because query_feed_mentions remained in lib.rs; passed after the move
• cargo fmt --all --check and git diff --check — passed
• cargo clippy -p buzz-db -p buzz-relay --all-targets -- -D warnings — passed
• cargo test -p buzz-db --quiet — 108 passed, 200 ignored; observability and all nine ownership guards passed
• Native PostgreSQL feed-query regressions — 3 passed: mentions, needs-action, and activity/global-only community scoping
• Native PostgreSQL routed_reads_are_confined_to_the_requested_community — passed, covering all three routed feed wrappers
• The unrelated insert_mentions_indexes_rosters_past_bind_parameter_cap fixture fails because migration 32 rejects its synthetic kind-39002 p-tags; the exact same failure was reproduced at parent head f614cc212c70c91aacd5e4013c0dc77f847bce8a
• cargo test -p buzz-relay --lib -- --test-threads=1 — 909 passed, 48 ignored
• Commit-time formatting, sadscan, attribution, and sign-off hooks — passed

Independent exact-head Blox review: buzz-tornquist-pr-6794-review (2051317) verified the exact head and parent merge-base, byte-identical SQL/tests, all six moved wrappers and unique spans, BOUNDED routing/session/fallback behavior, and the retained runtime confinement boundary. Formatting, strict clippy, 108 DB unit tests, source guards, targeted PostgreSQL feed/routing regressions, 22 non-ignored feed tests, and 909 relay tests passed. The sole ignored-feed fixture failure reproduced with the same SQLSTATE 23514 at the exact parent. No findings at any severity.

Generated with Codex

Superseded pre-comment restack verification

PR #6700 merged before publication completed. This layer was restacked onto current main through the exact parent named above; the final cumulative tip is 2ddcc8a. Cumulative author gates passed: formatting and diff checks; buzz-db and buzz-relay all-target clippy with -D warnings; DB lib 111 passed / 200 ignored; ownership 22/22; observability 1/1; the full isolated PostgreSQL domain matrix; and relay lib 910 passed / 49 ignored.

Outcome

No actionable findings.

Reviewed the exact direct-parent range ed21d81e7fe1fa7606c6e67412b788cc6df12916..ecd17550f7e6e7b4f25399a546072177a0eb20a6 on fresh Blox workstation buzz-tornquist-pr-6794-final-review (ID 2057633). The six feed Db wrappers and their spans move to feed.rs without SQL or routing behavior changes. The BOUNDED route predicate, replica transaction, route labels, and writer fallback remain unchanged; runtime route/session ownership stays in lib.rs.

Verification

• Formatting, range/worktree diff checks, touched-crate clippy, and clean-tree checks passed.
• Store-ownership guards: 9 passed; observability source guard: 1 passed.
• Non-PostgreSQL feed tests: 22 passed, 4 ignored.
• Relay consumer compile passed.
• Native PostgreSQL 17: all 4 ignored feed regressions passed, including the 11,000-member roster case.
• Final detached HEAD and merge-base were rechecked.

No code edits or external mutations were made. Buzz relay credentials/ownership reporting were unavailable under the documented fallback. The workstation was deleted after artifact transfer.

Artifacts

• Diff SHA-256: 3dbf7ffe4524534b2d44b0781d144acdbbfc4cedff8c8dcf395ceeb9da6c916a
• Verification log SHA-256: 25a3abe024c94c2939bc0745d034e3fa970aa8d44b29eba8cd63159f98c6de24
• Artifact archive SHA-256: 07c71432b4a2646290f040cb7314083ea8f0f6e722370bf9c6a0e78576bb7375

Comment-addressed restack

Review follow-up on #6777 removed only the low-value replaceable ownership source test. This PR was restacked onto its rewritten parent; its production patch is unchanged.

• Exact base: f18b0d3fdc45610d375637c2585d8ae589762735
• Exact head: 30621460f04c38467ea0df1731fce2763d696c04
• Final cumulative tip: 6fa2f104d42c6ba85bdf62e7ccb74ceaf4a84f67
• Per-layer patch-ID and tree audits confirm this PR’s production diff is unchanged from its pre-comment head.
• Cumulative Blox gate: formatting and diff checks; strict buzz-db/buzz-relay Clippy; DB lib 111 passed / 200 ignored; ownership 21/21; observability 1/1; every moved PostgreSQL test; relay lib 910 passed / 49 ignored.
• Independent re-review at this exact head: no findings; fresh exact-parent/head Blox review passed fmt/diff, strict buzz-db Clippy, current ownership/observability guards, feed tests (22 passed / 4 ignored), all 4 feed PostgreSQL tests, and relay compilation.