Fix critical memory safety issue in Transaction API

[TonyMasson]

🚨 Critical Memory Safety Fix

Problem

The Transaction API had a use-after-free vulnerability where Transaction stored a raw *mut CBLDatabase pointer without ensuring the underlying Database remains alive.

Dangerous scenario:

let transaction = {
    let mut db = Database::open("test", None)?;
    db.begin_transaction()?  // db dropped here\!
};
transaction.commit()?; // 💥 Use-after-free\!

Solution

Transaction now owns a Database clone instead of a raw pointer:

• Transaction::new() calls db.clone() which uses reference counting
• Database::clone() calls retain() to increment CBLDatabase ref count
• When Transaction is dropped, Database is automatically released
• CBLDatabase stays alive for the entire Transaction lifetime

Changes

• Transaction.db_ref: *mut CBLDatabase → Transaction.db: Database
• Transaction::new() takes &Database instead of *mut CBLDatabase
• All Transaction methods use self.db.get_ref() instead of raw pointer
• Memory safety now guaranteed through Rust's ownership system

Testing

• ✅ Existing tests pass (no functional change)
• ✅ Memory safety guaranteed by Rust ownership
• ✅ Clippy and formatting checks pass

Risk Assessment

• High priority fix - prevents undefined behavior
• No API breaking changes - same public interface
• No performance impact - reference counting is lightweight

🤖 Generated with Claude Code

[Nao-ris]

Pas sûr que ça compile côté billeo-engine, l'objet Database pourrait ne pas être transférable entre les threads. A tester.

[TonyMasson]

A réouvrir plus tard