feat(proxy): accept inbound EQL ciphertext payloads

[freshtonic]

Summary

• detect EQL v3 storage payloads in SQL literals and bind parameters before plaintext decoding
• validate payload version, inferred destination column, and exact configured SEM-term shape
• authenticate ciphertext with the connection's active scoped cipher and forward it without re-encryption
• project stored payloads into query operands where required and fail closed with a generic error
• cover parameter storage/search, literal storage, decryption, and destination mismatch in cipherstash-proxy-integration
• demonstrate application-side JSON encryption through parameter and literal inputs in the executable showcase

Testing

• cargo test -p cipherstash-proxy inbound_eql --lib
• cargo test -p cipherstash-proxy --lib (135 passed; one environment-sensitive config test passed when rerun alone)
• cargo test -p cipherstash-proxy config::tandem::tests::missing_database_config --lib -- --exact
• cargo clippy -p cipherstash-proxy --all-targets -- -D warnings
• cargo clippy -p cipherstash-proxy-integration -p showcase --all-targets -- -D warnings
• cargo test -p cipherstash-proxy-integration --no-run
• cargo test -p showcase --no-run
• cargo fmt --all -- --check

The runtime integration/showcase cases use the existing credentialed CI tasks. This checkout had no application/ZeroKMS credentials with which to start an isolated current-branch Proxy locally.

Linear: CIP-3822