fix: update sqlx and sqlite bindings for iOS simulator builds

[polw1]

Upgrade the SQLx/SQLite dependency chain so iOS simulator builds no longer
depend on BINDGEN_EXTRA_CLANG_ARGS in .cargo/config.toml.

• move sqlx to 0.9.0-alpha.1
• align libsqlite3-sys to 0.35.0
• update sqlx-sqlite-observer dependency constraints
• adapt toolkit code to sqlx 0.9 query safety and argument API changes

[velocitysystems]

Thanks @polw1. This PR includes several different changes. Are all of them necessary to resolve the issue, or are some just side effects of the dependency updates? Is it possible to simplify this down to the minimal required changeset?

[polw1]

I had kept Cargo.lock in the PR because the fix comes from a dependency resolution change, so I initially wanted to preserve the exact dependency tree I validated.

But I removed it as requested.

[velocitysystems]

Thanks @polw1. My question is more: What is the root change that triggered all of these changes? (And are all of them necessary)? Particularly the code-level changes.

[polw1]

The root change is the sqlx upgrade.

The original issue comes from the fact that sqlx-sqlite 0.8.6 pins libsqlite3-sys = 0.30.1, which is the version that reproduces the iOS simulator bindgen failure. Because of that, updating only libsqlite3-sys was not enough in this repo while staying on sqlx 0.8.6.

So the minimal dependency change was:

• move from sqlx 0.8.6 to sqlx 0.9.0-alpha.1
• align sqlx-sqlite-observer to libsqlite3-sys 0.35.0

The code-level changes are required by that sqlx upgrade:

• sqlx::query(&String) no longer compiles for these dynamic SQL paths, so those call sites had to move to
  sqlx::AssertSqlSafe(...)
• sqlx::sqlite::SqliteArguments no longer takes a lifetime parameter

I’m sorry for not explaining it better before

[velocitysystems]

That makes sense. My main concern is moving to an alpha package, especially given the number of breaking changes in the 0.9.x line. Could we get a sense of when 0.9.0 stable is expected to land before we commit?
cc: @jjhafer

[polw1]

I agree with that concern, and I was thinking the same thing.

As far as I can tell, 0.9.0-alpha.1 was published on October 2025, and there haven’t been any newer 0.9 prereleases or a stable 0.9.0 release since then.

I’m going to move this PR back to draft and keep watching the SQLx release line.

My concern is also the delay: if stable takes a while, we would be carrying an alpha dependency longer than we’d like.