Migrate db, auth, and config to mcdsl

- db.Open: delegate to mcdsl/db.Open
- db.Migrate: rewrite migrations as mcdsl/db.Migration SQL strings,
  delegate to mcdsl/db.Migrate; keep SchemaVersion via mcdsl
- auth: thin shim wrapping mcdsl/auth.Authenticator, keeps Claims
  type (with Subject, AccountType, Roles) for policy engine compat;
  delete cache.go (handled by mcdsl/auth); add ErrForbidden
- config: embed mcdsl/config.Base for standard sections (Server with
  Duration fields, Database, MCIAS, Log); keep StorageConfig and
  WebConfig as MCR-specific; use mcdsl/config.Load[T] + Validator
- WriteTimeout now defaults to 30s (mcdsl default, was 0)
- All existing tests pass (auth tests rewritten for new shim API,
  cache expiry test removed — caching tested in mcdsl)
- Net -464 lines

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/db/db.go

@@ -3,10 +3,8 @@ package db
 import (
 	"database/sql"
 	"fmt"
-	"os"
-	"path/filepath"
 
-	_ "modernc.org/sqlite"
+	mcdsldb "git.wntrmute.dev/kyle/mcdsl/db"
 )
 
 // DB wraps a SQLite database connection.
@@ -16,34 +14,11 @@ type DB struct {
 
 // Open opens (or creates) a SQLite database at the given path with the
 // standard Metacircular pragmas: WAL mode, foreign keys, busy timeout.
+// The file is created with 0600 permissions.
 func Open(path string) (*DB, error) {
-	dir := filepath.Dir(path)
-	if err := os.MkdirAll(dir, 0700); err != nil {
-		return nil, fmt.Errorf("db: create directory %s: %w", dir, err)
-	}
-
-	sqlDB, err := sql.Open("sqlite", path)
+	sqlDB, err := mcdsldb.Open(path)
 	if err != nil {
-		return nil, fmt.Errorf("db: open %s: %w", path, err)
+		return nil, fmt.Errorf("db: %w", err)
 	}
-
-	pragmas := []string{
-		"PRAGMA journal_mode = WAL",
-		"PRAGMA foreign_keys = ON",
-		"PRAGMA busy_timeout = 5000",
-	}
-	for _, p := range pragmas {
-		if _, err := sqlDB.Exec(p); err != nil {
-			_ = sqlDB.Close()
-			return nil, fmt.Errorf("db: %s: %w", p, err)
-		}
-	}
-
-	// Set file permissions to 0600 (owner read/write only).
-	if err := os.Chmod(path, 0600); err != nil {
-		_ = sqlDB.Close()
-		return nil, fmt.Errorf("db: chmod %s: %w", path, err)
-	}
-
 	return &DB{sqlDB}, nil
 }