Data browser core: read any SQLite file a viewer may see — the forge's own (admins) and each app's per environment (its writers) — tables, rows, read-only SQL, secrets masked #7579

Part of #7578. This is the foundation, and it replaces #7573.

Build: src/data/ (new files):

• listSources(viewer) returns the forge's own database (admins only) and, for each app the viewer can write, its environments' .db files under FORGE_APP_DATA.
• tables(source) with row counts.
• rows(source, table, {filter, order, page}).
• query(source, sql) runs SELECT/WITH only, on a read-only connection, with a 5 s cap and a 1,000-row cap.
• Masking: columns that hold secrets (tokens, keys, password hashes, sealed values, _secret, _token) are masked by rule, with a per-source allowlist.
• Each source opens on demand and closes after use. It never holds a writer lock, and a busy WAL never blocks the app.

Tests:

• A reader of an app can't see its data (404).
• A writer sees their app's production and preview databases.
• Only an admin sees forge.db.
• INSERT and PRAGMA writable_schema are refused.
• A token column is masked.
• A slow query stops at 5 s.

Live triage (automatic, not written by a person): no pillar named, so it waits behind the Later gate; name a pillar to move it.

Parked by the crew: the check stayed red through 2 automatic tries (pull #7585 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.