refactor: introduce database provider abstraction, isolate MSSQL layer

- Add provider contract (src/providers/provider.js): query() -> {rows,
  rowsAffected, insertId}, callback transaction(fn), exec() for stored
  procs, initialize/purge lifecycle
- Add MssqlProvider (src/providers/mssql/index.js) wrapping an mssql
  ConnectionPool with normalized results, tx commit/rollback and
  constraint-error classifiers (unique 2627/2601, FK 547)
- LibDashStore constructor now takes a provider instead of a pool
  (breaking); adds LibDashStore.create() async factory; keeps pool as
  transitional bridge until store modules are converted (see TODO.md)
- Move MSSQL-specific code into the provider: src/sql/* ->
  src/providers/mssql/queries/*, src/schema.js ->
  src/providers/mssql/schema.js, purge SQL -> purgeSql.js
- Update scripts, generate-schema-graph.js and package.json exports
  (./providers/mssql, ./providers/provider)
- Add TODO.md with the remaining provider/SQLite migration plan

No SQL or behavioral changes.

src/providers/mssql/queries/manifestattachment.js

@@ -0,0 +1,104 @@
+export const CHECK_MANIFEST_ACCESS = `
+SELECT id, company_id AS companyId
+FROM manifest
+WHERE id = @manifestId AND company_id = @companyId
+`;
+
+export const CREATE_FILE = `
+INSERT INTO [file] (hash, mimetype, name, size, created, modified, content, thumbavif, thumbx, thumby, meta)
+OUTPUT INSERTED.id
+VALUES (@hash, @mimetype, @name, @size, @created, @modified, @content, CONVERT(VARBINARY(MAX), @thumbavif), @thumbx, @thumby, @meta)
+`;
+
+export const GET_NEXT_SORT = `
+SELECT ISNULL(MAX(sort), -1) + 1 AS sort
+FROM manifestattachment
+WHERE manifest_id = @manifestId;
+`;
+
+export const CREATE_ATTACHMENT = `
+INSERT INTO manifestattachment (manifest_id, file_id, sort)
+OUTPUT INSERTED.id
+VALUES (@manifestId, @fileId, @sort)
+`;
+
+export const LIST_BY_MANIFEST = `
+SELECT 
+    ma.id,
+    ma.manifest_id AS manifestId,
+    ma.file_id AS fileId,
+    ma.sort,
+    f.hash,
+    f.mimetype,
+    f.name,
+    f.size,
+    f.created,
+    f.modified,
+    f.thumbavif,
+    f.thumbx,
+    f.thumby,
+    f.meta
+FROM manifestattachment ma
+INNER JOIN [file] f ON f.id = ma.file_id
+WHERE ma.manifest_id = @manifestId
+ORDER BY ma.sort ASC, ma.id ASC
+`;
+
+export const GET_BY_ID = `
+SELECT 
+    ma.id,
+    ma.manifest_id AS manifestId,
+    ma.file_id AS fileId,
+    ma.sort,
+    f.hash,
+    f.mimetype,
+    f.name,
+    f.size,
+    f.created,
+    f.modified,
+    f.content,
+    f.thumbavif,
+    f.thumbx,
+    f.thumby,
+    f.meta
+FROM manifestattachment ma
+INNER JOIN [file] f ON f.id = ma.file_id
+WHERE ma.manifest_id = @manifestId
+  AND (ma.id = @id OR ma.file_id = @id)
+`;
+
+export const FIND_ATTACHMENT = `
+SELECT ma.id, ma.file_id AS fileId
+FROM manifestattachment ma
+WHERE ma.manifest_id = @manifestId
+  AND (ma.id = @id OR ma.file_id = @id)
+`;
+
+export const DELETE_ATTACHMENT = `
+DELETE FROM manifestattachment
+WHERE id = @id
+`;
+
+export const DELETE_FILE = `
+DELETE FROM [file]
+WHERE id = @fileId
+`;
+
+export const LIST_IDS_BY_MANIFEST = `
+SELECT id
+FROM manifestattachment
+WHERE manifest_id = @manifestId
+ORDER BY sort ASC, id ASC;
+`;
+
+export const SET_TEMP_SORTS = `
+UPDATE manifestattachment
+SET sort = -id
+WHERE manifest_id = @manifestId;
+`;
+
+export const UPDATE_SORT = `
+UPDATE manifestattachment
+SET sort = @sort
+WHERE id = @id AND manifest_id = @manifestId;
+`;