fix(db): bound every pool liveness ping so a dead connection cannot strand its slot

Against the pooler on :6543 sqlx's unbounded paths never complete: the recycle path awaits PgConnection::close(), and both the acquire-time and release-time ping() calls await a reply that a silently-dropped connection never sends. Each one hangs its task while holding the slot's DecrementSizeGuard, so the slot is never returned and the socket stays ESTABLISHED forever.

That leaked a slot roughly every 23 minutes, exhausting all 10 slots about 3h40m after every boot, after which every acquire burned the full 10s acquire_timeout and the site served 500s until it was restarted. Observed three times: Aug 5 06:53 boot died 10:32, Aug 7 06:43 died 10:35, Aug 7 13:32 died 17:11.

Drop idle_timeout/max_lifetime to remove the recycle path, and replace test_before_acquire with before_acquire/after_release hooks that ping under a 2s timeout. The hooks report a dead connection as Err, never Ok(false), because sqlx answers Err with the bounded close_hard() and Ok(false) with the same unbounded close() that caused the leak.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com