Restructure the controller storage layer into three distinct layers with
clear ownership boundaries:

- db.py: pure SQLite infrastructure (TransactionCursor, QuerySnapshot,
  read pool). No domain knowledge; no store ownership.
- schema.py: DDL (Table/Column) plus row dataclasses. Introduces a
  @Projection decorator and pcolumn() field helper that derive the
  column→dataclass mapping from the dataclass definition itself,
  eliminating ~160 lines of hand-written decode boilerplate and unifying
  the three TaskDetailRow query variants on one decoder.
- store.py: per-table domain stores (TaskStore / JobStore / WorkerStore
  / EndpointStore / DispatchStore / UserStore) plus ControllerStores,
  the process-scoped container. `ControllerStores.from_db(db)` is the
  single entry point; `transact()` and `read()` hand out a per-scope
  ControllerStore bundling a Cursor and the stores, and the caller can
  pass either `ctx` (an object with `.cur` and the stores) or `ctx.cur`
  into store methods. Read scope hands out a read-only connection, so
  any write raises OperationalError — locked in by a regression test.

The inversion (stores own db, not the other way around) removes the
prior circular setup where ControllerDB constructed and attached its
stores. Stores no longer carry `self._db`; every method takes an
explicit cursor. The `JobStore.attach_tasks` fixup for the TaskStore ↔
JobStore cycle is replaced by passing `tasks: TaskStore` into the two
methods that need it.

Deletes that fall out of the refactor:
- endpoint_registry.py: folded into EndpointStore
- constraints.py: unused
- MetaStore / PruneStore / ReservationStore + the worker attribute cache:
  all dead or better expressed as plain store methods
- test_reservation_holder_reset_regression.py: guarded a cache that no
  longer exists

Tier-1 cleanups landed alongside:
- sql_placeholders(n) helper (24 sites)
- WhereBuilder for building optional AND-joined predicates (3 sites)
- AttemptFinalizer.build(...) classmethod (7 of 8 sites)
- Test helpers (`*_for_test` methods) moved from ControllerTransitions
  into tests/cluster/controller/_testing.py where they belong.

ControllerTransitions, ControllerServiceImpl, ActorProxy, the dashboard,
and the benchmark script are all rewired to take ControllerStores
instead of ControllerDB. Tests updated accordingly; the remaining
`state._db` references are intentional (infra calls like
`db.snapshot()` / `db.wal_checkpoint()`).