sqlite persistence: the store moves from db.json to dist.db (P5.2)

src/repo/db.sx persists the whole Repo to <store>/dist.db through the
vendored SQLite bindings, keeping the load-whole/save-whole call shape.
One table per entity; enums as lowercase variant names; list order
round-trips via rowid. Enforced uniqueness: apps.slug,
channels(app_id, name), tokens.token_hash; lookup indexes on
releases(app_id) and artifacts(sha256) (non-unique - identical bytes
may ship in several releases). save is DELETE-all + INSERT-all inside
BEGIN IMMEDIATE...COMMIT with rollback on failure; every connection
sets busy_timeout so the CLI and a running distd interleave safely.

A store holding only a pre-SQLite db.json imports once on first load,
then the file is renamed db.json.imported; a store with neither starts
empty. Consumers gate on db.store_exists instead of probing db.json.
The JSON read-back stays for the import path; the entity->json writers
stay for distd's /api responses.

Tests that parsed db.json directly now assert by querying dist.db
through the SQLite bindings; tests/db_import.sx pins the import path;
tests/repo_roundtrip.sx pins the SQLite round-trip. make test 22/22.

src/server/auth.sx

@@ -12,7 +12,7 @@
 //   403 Forbidden — the token exists but `check_token` refuses it; the
 //       code names the refusal (auth.revoked / auth.expired /
 //       auth.missing_scope / auth.app_forbidden / auth.channel_forbidden).
-//   503 Unavailable — db.json exists but could not be loaded.
+//   503 Unavailable — the store database exists but could not be loaded.
 //
 // The presented secret is re-hashed (`digest_of_bytes`, the store's
 // SHA-256) and matched against hashes at rest — the secret itself is never
@@ -94,7 +94,7 @@ authenticate :: (store_dir: string, headers: string, scope: string, app_slug: st
     }
     presented_hash := digest_of_bytes(sq!);
 
-    if !exists(path_join(store_dir, "db.json")) {
+    if !db.store_exists(store_dir) {
         fail_out.code    = "auth.unknown_token";
         fail_out.message = "unknown token";
         raise error.Unauthorized;
@@ -102,7 +102,7 @@ authenticate :: (store_dir: string, headers: string, scope: string, app_slug: st
     repo, le := db.load(store_dir);
     if le {
         fail_out.code    = "store.load";
-        fail_out.message = concat("db.json under the store could not be loaded: ", store_dir);
+        fail_out.message = concat("the store database could not be loaded: ", store_dir);
         raise error.Unavailable;
     }