feat(resource): add database resources

Implement database resource types (postgres, mysql, sqlite, duckdb)
with connection args, auth handling, and transaction-based sandbox
strategy using BEGIN/ROLLBACK/COMMIT wrappers.

Key changes:
- Add DatabaseResourceHandler with 4 database type definitions
- Implement TransactionSandbox for transaction_rollback strategy
- Wire TransactionSandbox into SandboxFactory
- Register database types in bootstrap_builtin_types
- Add connection validation with credential masking
- Add Behave BDD tests, Robot integration tests, ASV benchmarks

ISSUES CLOSED: #342

robot/database_resources.robot

@@ -0,0 +1,73 @@
+*** Settings ***
+Documentation    Integration smoke tests for database resource types and transaction sandbox
+Resource         ${CURDIR}/common.resource
+Suite Setup      Setup Test Environment
+Suite Teardown   Cleanup Test Environment
+
+*** Variables ***
+${HELPER}    ${CURDIR}/helper_database_resources.py
+
+*** Test Cases ***
+Database Handler Protocol Conformance
+    [Documentation]    Verify DatabaseResourceHandler satisfies ResourceHandler
+    ${result}=    Run Process    ${PYTHON}    ${HELPER}    protocol-check    cwd=${WORKSPACE}
+    Log    ${result.stdout}
+    Log    ${result.stderr}
+    Should Be Equal As Integers    ${result.rc}    0
+    Should Contain    ${result.stdout}    protocol-check-ok
+
+Database Type Definitions Present
+    [Documentation]    Verify all 4 database type definitions are present
+    ${result}=    Run Process    ${PYTHON}    ${HELPER}    type-defs    cwd=${WORKSPACE}
+    Log    ${result.stdout}
+    Log    ${result.stderr}
+    Should Be Equal As Integers    ${result.rc}    0
+    Should Contain    ${result.stdout}    type-defs-ok
+
+SQLite Connection Validation
+    [Documentation]    Verify SQLite connection validation succeeds
+    ${result}=    Run Process    ${PYTHON}    ${HELPER}    sqlite-validate    cwd=${WORKSPACE}
+    Log    ${result.stdout}
+    Log    ${result.stderr}
+    Should Be Equal As Integers    ${result.rc}    0
+    Should Contain    ${result.stdout}    sqlite-validate-ok
+
+Transaction Sandbox Commit
+    [Documentation]    Verify TransactionSandbox commit persists data
+    ${result}=    Run Process    ${PYTHON}    ${HELPER}    tx-commit    cwd=${WORKSPACE}
+    Log    ${result.stdout}
+    Log    ${result.stderr}
+    Should Be Equal As Integers    ${result.rc}    0
+    Should Contain    ${result.stdout}    tx-commit-ok
+
+Transaction Sandbox Rollback
+    [Documentation]    Verify TransactionSandbox rollback discards data
+    ${result}=    Run Process    ${PYTHON}    ${HELPER}    tx-rollback    cwd=${WORKSPACE}
+    Log    ${result.stdout}
+    Log    ${result.stderr}
+    Should Be Equal As Integers    ${result.rc}    0
+    Should Contain    ${result.stdout}    tx-rollback-ok
+
+Credential Masking In Validation
+    [Documentation]    Verify credentials are masked in validation output
+    ${result}=    Run Process    ${PYTHON}    ${HELPER}    cred-mask    cwd=${WORKSPACE}
+    Log    ${result.stdout}
+    Log    ${result.stderr}
+    Should Be Equal As Integers    ${result.rc}    0
+    Should Contain    ${result.stdout}    cred-mask-ok
+
+SandboxFactory Transaction Rollback Routing
+    [Documentation]    Verify SandboxFactory creates TransactionSandbox for transaction_rollback
+    ${result}=    Run Process    ${PYTHON}    ${HELPER}    factory-routing    cwd=${WORKSPACE}
+    Log    ${result.stdout}
+    Log    ${result.stderr}
+    Should Be Equal As Integers    ${result.rc}    0
+    Should Contain    ${result.stdout}    factory-routing-ok
+
+Read Only Enforcement
+    [Documentation]    Verify read-only mode prevents writes
+    ${result}=    Run Process    ${PYTHON}    ${HELPER}    read-only    cwd=${WORKSPACE}
+    Log    ${result.stdout}
+    Log    ${result.stderr}
+    Should Be Equal As Integers    ${result.rc}    0
+    Should Contain    ${result.stdout}    read-only-ok