feat: modern SQL Server connectivity + TDS protocol + ergonomic APIs

[MattJackson]

The feature layer of the sync — modern connectivity, deeper TDS protocol coverage, and ergonomic APIs.

⚠️ Contains a breaking change — refactor!: drop async-std (dual-runtime tests retargeted to tokio + smol). Warrants a minor/major version bump per your scheme, not a patch.

• Connectivity/TLS: TDS 8.0 strict encryption + hostname_in_certificate + client_name; MultiSubnetFailover; SSPI/NTLM on Unix via sspi-rs; client-certificate (mTLS); named-pipes example.
• Protocol/tokens: decoders for SESSIONSTATE, COLINFO, FEDAUTHINFO, TABNAME, UDT, SQL_VARIANT (decode + encode), ALTMETADATA/ALTROW; Attention signal + query cancellation.
• APIs: optional serde; ConfigBuilder; column_metadata() + identity accessors; Transaction Manager (begin/commit/rollback); named-procedure RPC with OUT params + table-valued parameters via a new tiberius-macros derive crate; TokenRow accessor; more IntoSql/FromSql conversions; DateTime2→datetime coercion under tds73.

Granular per-feature commit history preserved.

Supersedes #132, #298, #314, #328, #331, #357, #366, #378, #398, #408, #413, #416.

Sequential series — merge after #432, #433, #434. Based on main; diff reduces to its own 36 commits as the earlier PRs land.
Reviewer note: please rebase-merge or merge-commit, not squash.

[MattJackson]

@aqrln rebased onto the merged main, all green and MERGEABLE — ready for review whenever you get a chance. Thanks!

[MattJackson]

Updated + green. Fixed a compile break, added decode-time validation of server-supplied numeric scale/precision and sql_variant element lengths, and corrected the ColumnFlag bit layout to MS-TDS §2.2.7.4 — the usUpdateable polarity was inverted and the Computed/SparseColumnSet/Encrypted bit positions were offset. is_updateable() now means "not read-only" (read/write or unknown), since SQL Server reports usUpdateable = unknown for many valid bulk-target columns; this is server-verified by a new identity/computed bulk test. Also made the TVP derive bind owned String/Vec<u8> fields (the documented GUIDE example now compiles and is tested) and made the connection-string trust-cert conflict return an error instead of panicking.