feat(sql): the database helper and the TOTP helper, as subcommands

`crafter-review sql` hands the SQL to the driver's broker named in
REVIEW_GATES_DB; the broker runs it as one transaction, rolled back, and
streams the lines back with the exit code last. The client speaks protocol
3.0 over Crafter.Network's TCP client: cleartext, MD5 and SCRAM-SHA-256,
one Parse per statement, the transaction status as the backstop. The
splitter, the refusals, the table layout and every message work on code
points; connect and socket errors read "[Errno 111] Connection refused"
or "timed out". `crafter-review totp` prints "123456 (valid 17s)".

No sleep after the last connect attempt; TOTP reads the clock once; a
broker token that is no string gets the NO DATABASE answer and the exit
mark.

The goldens add the splitter, the comment stripping, the fingerprint, the
refusals, the first words, the headline, the cell, table, error and notice
layouts, the run's refusals and limits and 40 TOTP codes (2774 checks
now). tests/PgWire runs the helper over a Postgres stand-in and compares
its output with the goldens, line for line, plus the broker's protocol.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

interfaces/Crafter.Review-Totp.cppm

@@ -0,0 +1,23 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// SPDX-FileCopyrightText: Copyright (C) 2026 Catcrafts®
+
+export module Crafter.Review:Totp;
+import std;
+
+// A current TOTP code (RFC 6238, SHA-1, 30 s, 6 digits) for a login fixture:
+// what the functional lens types into the one-time-code field.
+export namespace Crafter::Review::Totp {
+    struct Code {
+        std::string code;
+        // The seconds left in its window.
+        std::int32_t left;
+    };
+    // secret: base32, spaces and case as a seeder writes it; std::invalid_argument
+    // with binascii's message for one that is no base32. The clock is read once,
+    // so the code and the seconds left belong to the same window.
+    Code At(std::string_view secret, double now, std::int32_t step = 30, std::int32_t digits = 6);
+    // `crafter-review totp <fixture.json>` or `--secret <base32>`: prints
+    // "123456 (valid 17s)". Exit 1 for a fixture without a secret or a bad
+    // command line.
+    std::int32_t Main(std::span<const std::string_view> args);
+}