feat: cancel the server-side statement on a host cancel notification (#126)

[aesslinger]

What

Implements the plugin-side half of #126 — cancel the server-side statement when the host sends a cancel notification. Companion to TabularisDB/tabularis#832 (still OPEN), which will ship the host half: sending a fire-and-forget cancel notification when its plugin-call timeout fires. Today a timed-out execute_query abandons the JSON-RPC slot but leaves the Postgres backend running the statement — an orphaned query holding locks. This PR makes the plugin stop it.

Design (agreed in the tabularis#832 thread — host owns when, plugin owns how): each in-flight execute_query/execute_query_batch/explain_query registers a tokio_postgres::CancelToken keyed by request id, and on a cancel notification for a known id, sends pg_cancel_backend via a fresh matching-TLS connection. The in-flight query then resolves through its normal Err path ("canceling statement due to user request") as a normal error response for the original call. An unknown id (already finished, or arrived after cleanup) is a no-op, never an error.

Changes

• src/cancel.rs (new) — CancelGuard RAII registry. register builds a boxed cancel action from the live CancelToken + ConnectionParams; drop deregisters on every return path (Ok or Err) so the map can't leak. cancel(id) runs the one-shot action. run_cancel picks NoTls vs make_tls_connect via needs_tls, matching the pool's two-branch shape; errors are logged and swallowed (fire-and-forget).
• src/handlers/query.rs — cancel handler; CancelGuard threaded into run_batch_in_session (session + non-session paths) and exec_query.
• src/rpc.rs — "cancel" dispatch; handle_line returns Option<Value>, None for a notification (no top-level id field) so no response is written. Notification-ness is decided by absence of the id field, not by method (id: null is a request whose id is null, not a notification).
• src/main.rs — run_worker skips the stdout write for None — a stray response line for a notification would corrupt the protocol stream.
• src/client.rs — pub(crate) make_tls_connect + pub(crate) needs_tls. Also fixes a real bug the helper's doc had: make_tls_connect always builds a TLS connector with no NoTls fallback, so callers must check needs_tls first (the pool already does this two-branch shape); cancel::run_cancel does the same.
• src/bin/test_plugin.rs — handles the new Option<Value> return.
• Tests — 5 cancel-registry unit tests (src/cancel_tests.rs, fake boxed action — a real CancelToken needs a live connection) + an #[ignore]-gated live test that sends pg_sleep(30), cancels it, and confirms via pg_stat_activity the backend stops.

Envelope

Per the issue's proposed shape (tabularis#832 hasn't fixed it yet): {"method":"cancel","params":{"id":<request-id>}} as a true id-less notification. If the host settles on a different shape, only rpc.rs's dispatch string + the cancel handler's param read change — the registry and the query-handler threading are envelope-agnostic.

Backward compatibility & dormancy

No host sends cancel today (verified: no cancel wiring on upstream/main). The new dispatch is never hit; CancelGuard register/drop is two cheap HashMap ops per query with no output change — byte-identical responses for every existing RPC. Dormant until tabularis#832 ships; safe to merge now (zero breakage) and lights up when #832 lands.

Ahead of the builtin for this one behavior (the builtin's cancel_query_impl only aborts its local tokio task, never calls pg_cancel_backend) — flagged per the repo's "don't improve on the builtin silently" rule, but scoped to a bug the reporter explicitly asked to fix.

Verification

• cargo build --release
• Cross-repo 83-test byte-for-byte parity suite (POSTGRES_PLUGIN_BIN against tabularis' src-tauri/tests/postgres_integration parity*): 83/83 pass — no existing behavior regressed.
• 361 unit tests pass (5 new cancel-registry).
• 30 live-DB tests pass (2 ignored: the new cancel test + the pgvector one; run the cancel test with --include-ignored).
• cargo clippy --all-targets -- -D warnings; cargo fmt --all --check; npx markdownlint CHANGELOG.md — all clean.

Closes #126.

[github-actions]

Version suggestion

Based on this PR's title (feat) and the prerelease:rc label:

Current	1.0.0-rc.5
Suggested next tag	v1.0.0-rc.6

This is informational only — no tag or release is created automatically yet.

[github-actions]

Version suggestion

Based on this PR's title (feat) and the prerelease:rc label:

Current	1.0.0-rc.5
Suggested next tag	v1.0.0-rc.6

This is informational only — no tag or release is created automatically yet.