fix(snapshot/cdc): keyset pagination, cursor resume, per-pipeline offsets, rollback on cancel

[lekhrocks]

Summary

Hardens snapshot reading and CDC change capture. Fixes pagination correctness under concurrent writes, resume accuracy, per-pipeline offset isolation, and commit/rollback semantics on cancel.

Snapshot

• Keyset pagination over a single-column PK (WHERE pk > cursor ORDER BY pk LIMIT size) replaces OFFSET — stable under concurrent writes, single-pass, no offset drift or row duplication. Falls back to OFFSET when no single-column PK exists.
• SQL injection guard: the PK identifier is validated against [A-Za-z_][A-Za-z0-9_]* before interpolation.
• Cursor-driven resume: the keyset cursor is threaded through the read loop and checkpointed, so a resume continues at the exact next row (was recomputing the offset from a batch counter, which drifted on partial batches).
• Row estimation: uses the Postgres reltuples planner estimate instead of a full SELECT COUNT(*); falls back to COUNT on non-Postgres.
• Progress: aggregates row/batch estimates across all mapped tables (was first-table-only).
• Rollback on cancel/failure: writer.rollback() for cancelled/failed jobs so partial writes are not committed — a later resume would otherwise duplicate rows. Commit happens only on success.

CDC

• Per-pipeline offset file (host_db_pipeline): multiple pipelines on the same database no longer share/corrupt the Debezium position. CaptureLifecycle passes pipelineId in the connector context.
• Per-table LSN retention: updateOffset merges instead of replaces.
• Test reset path aligned to the keyed offset filename.

Validation

• All 11 CDC integration tests pass
• Full ./gradlew test green