feat: add durable provider cache

Add a private provider-neutral SQLite WAL cache with transactional migrations, retained raw payloads and tombstones, per-window opaque checkpoints, and reserved outbox/conflict tables.

Verify migrations, permissions, identity invariants, concurrent access, atomic pull-page rollback, and future-schema rejection with deterministic tests. No OAuth, networking, secrets, or Graph synchronization is included yet.

shell.nix

@@ -9,5 +9,6 @@ pkgs.mkShell {
 
   buildInputs = with pkgs; [
     gcc
+    sqlite
   ];
 }