feat(sql): add a statement extension seam behind the sql feature

An embedder can extend the SQL dialect with its own statements, but has
had nowhere to say what a statement *is*: its grammar, the label it
reports to an audit log, and the access it needs are three separate
facts, and describing them separately means a host ends up with parallel
downcast chains that must be kept in step by hand. Adding a statement to
only two of the three is a silent gap rather than a compile error.

`lancedb::sql` gains the seam that keeps them together:

- `CustomSqlHandler` contributes a grammar; `route_custom_sql` picks the
  one that owns a statement and leaves the rest to DataFusion.
- `SqlStatement` pairs a planned node with its audit label and the
  `AccessRequirement`s it needs. The vocabulary names what is reached
  for -- read, write, own, create, database, namespace, system -- rather
  than a privilege, so no access-control model has to live in the
  dialect.
- `StatementRegistry` holds both, with the consultation order it is
  given. Registration is front-insertion so an extension can get ahead
  of a catch-all that would otherwise swallow its keyword.
- `WriteObserver` reports a committed write without the statement
  knowing how its host represents that.
- `DmlResult` carries what a DML statement did as a one-row batch.

The feature adds no dependency that is not already required, so it is on
by default; the flag is there so an embedder that does not want the
surface can opt out.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

nodejs/Cargo.toml

@@ -44,6 +44,6 @@ aws-lc-rs = "=1.16.3"
 napi-build = "2.3.1"
 
 [features]
-default = ["remote", "lancedb/aws", "lancedb/gcs", "lancedb/azure", "lancedb/dynamodb", "lancedb/oss", "lancedb/huggingface", "lancedb/goosefs", "lancedb/metrics-otel"]
+default = ["remote", "lancedb/sql", "lancedb/aws", "lancedb/gcs", "lancedb/azure", "lancedb/dynamodb", "lancedb/oss", "lancedb/huggingface", "lancedb/goosefs", "lancedb/metrics-otel"]
 fp16kernels = ["lancedb/fp16kernels"]
 remote = ["lancedb/remote"]