feat: propagate trace context into SQL statements as comments

[zantvoort]

Traces show which application code ran a query; the database's own diagnostics — slow query logs, statement views — show statements with no link back to the request that issued them. The sqlcommenter convention bridges the two: the current trace context rides along as a statement comment, so a slow-log entry correlates directly to the trace, and the trace to the exact database-side execution.

Fixes #232

What's included

• SqlCommenter SPI (storm-core): contributes per-execution comment content, appended after all statement processing and caching, immediately before the statement is prepared — so Storm's template cache, SQL capture, observations, and logging all keep seeing the clean statement while the database sees the comment. Configured per template via the builder in all three language surfaces (core, Java, Kotlin).
• Hardened by construction: a commenter can never alter the statement. Content containing the comment terminator is rejected (the only escape from a block comment), semicolons are rejected (inert to the SQL parser, but naive statement splitters in drivers and proxies split on them; sqlcommenter values URL-encode them instead), and the emitted comment is padded with spaces so MySQL/MariaDB never interpret leading ! or + as an executable comment or optimizer hint.
• TraceContextSqlCommenter (storm-micrometer): renders the current span as a W3C traceparent value in sqlcommenter format (traceparent='00-{traceId}-{spanId}-{flags}'); statements execute uncommented when no span is current. micrometer-tracing is an optional dependency.
• Opt-in activation everywhere: storm.tracing.sql-comments=true in the Spring Boot starters (with a Tracer bean present, via the shared StormTracingAutoConfiguration), and the sqlCommenter slot on the Ktor plugin and its database("...") blocks with plugin-level inheritance. Off by default: a per-execution comment changes the statement text on every call, which defeats driver-side and server-side prepared statement caching — the docs state the trade-off.

Verification

• End-to-end append proof through a capturing JDBC proxy; empty-comment passthrough; comment-terminator rejection; semicolon rejection; executable-comment-marker neutralization (content starting !40101 stays a plain comment); traceparent format via SimpleTracer.
• Starter test: commenter bean absent by default even with a Tracer present, present with the property set.
• Full Spring/starter suites green; full reactor running at PR time on the same tree that passed all module suites.

Docs: Observability sections of spring-integration.md and ktor-integration.md, the yaml examples, and the changelog entry with the caching trade-off and the hardening guarantees.