Docs: warn plugin authors never to open bb.db with a second SQLite library inside the server process #4943

Summary

Plugins run inside the server process, and the SDK hands them the path to that process's data directory (bb.server.experimental_dataDir, documented as "the one holding config.json, bb.db"). With Node's built-in node:sqlite a plugin can open bb.db with zero dependencies. If it does, the server has two independent SQLite libraries (bb's better-sqlite3 and node:sqlite) holding the same database file in one process. SQLite documents this as a corruption scenario: https://www.sqlite.org/howtocorrupt.html#multiple_copies_of_sqlite_linked_into_the_same_application (POSIX advisory locks are per process, so one library's close() can drop the locks the other library believes it holds).

We came close to this with a test plugin that opened bb.db through node:sqlite in the server process; we did not isolate a reproduction of actual corruption, so this issue is only about the documentation gap. The plugin guide currently says nothing about it, and the experimental_dataDir doc comment invites reading bb-managed files from that directory.

Where the docs are today

• plugins/bb-guide/skills/bb-plugin-authoring/references/backend-foundation.md:110-126 — describes bb.storage.kv, bb.storage.database() and bb.storage.migrate, no warning about the server database.
• packages/plugin-sdk/src/backend-contract.ts:1875-1885 — experimental_dataDir: "For reading bb-managed files a plugin is migrating away from ... deliberately not a place to write." bb.db is a bb-managed file in that directory, and a read-only node:sqlite open still takes and releases locks.
• packages/plugin-sdk/src/backend-contract.ts:180-190 — bb.storage.database() returns the plugin's own <dataDir>/plugins/<id>/data.db using the server's better-sqlite3; it is the supported way to get a SQLite database, but it does not give access to bb.db, and nothing says a plugin must not bring its own SQLite build.

Suggested direction

Add a short note to the storage section of the plugin guide and to the experimental_dataDir doc comment:

• Never open bb.db from plugin code running in the server process, not even read-only, and not with node:sqlite, a second better-sqlite3 copy, or any other SQLite build. Use bb.storage.kv, bb.storage.database() (plugin-owned data.db) or bb.sdk for anything that lives in bb.db.
• Name the failure mode (lock loss between two SQLite libraries in one process, risk of lost writes or corruption) and link the SQLite page above.

Related, not duplicates: #1919 (closed; storage.database() handle leak), #2190 (open; database silently reverted to an old state, cause unknown).