rc-sqlxlisted

# SQLx 0.8 + PostgreSQL Async SQL for Rust without a heavy ORM. Target: **sqlx 0.8.x**, **PostgreSQL 16** (compatible with 14+). Complements `rc-sql` (general SQL design) and `rc-axum` (HTTP layer). ## Core workflow 1. **Schema first** — migrations under version control; no ad-hoc prod DDL from app code without a migration path. 2. **Pool** — one `PgPool` in app state; tune `max_connections` to VPS/DB limits. 3. **Queries** — always **bind** parameters (`$1`, `$2`); never `format!` user input into SQL. 4. **Mapping** — `query_as` / `FromRow` or compile-time `query_as!` when `DATABASE_URL` is available at build. 5. **Transactions** — multi-step writes use `pool.begin()` → commit/rollback. 6. **Security** — least-privilege DB role; secrets only in env. Read `references/security.md`. 7. **Test** — `sqlx::test` or isolated DB. Read `references/testing.md`. ## Reference guide | Topic | File | Load when | | ----- | ---- | --------- | | Pool, query_as, transactions, macros | `references/guide.md` | Implementing queries | | Injection, roles, secrets | `references/security.md` | Reviewing data access | | Migrations (sqlx-cli / embed) | `references/migrations.md` | Schema changes | | Integration tests | `references/testing.md` | DB tests | ## Must do - Use **bound** parameters for all dynamic values (Postgres `$n`). - Prefer `query_as::<_, T>` or `query_as!` into serde/FromRow structs. - Set pool size consciously (small VPS: start with 5–10). - Run migrations in deploy pipeline