[J2TeamNNL]

Summary

• New registry plugin Neo4jDriverPlugin. It talks Bolt itself, on the SwiftNIO and NIOSSL packages the Kafka plugin already links, so there is no new dependency. The handshake offers Bolt 5.4 down to 5.0, then 4.4 down to 4.2.
• TableProNeo4jCore holds the parts that need no socket: PackStream (nesting capped at 64 levels), Bolt messages and chunking, value text, the Cypher the grid sends, and the rows it gets back.
• Plugins/SharedNIO/PluginNIOChannel.swift: the cancellable NIO connect, the TLS context and the connect error text, shared by Kafka and Neo4j instead of copied.
• Sidebar: each database from SHOW DATABASES, with Labels and Relationship Types inside, as the plugin's schemas. A user refused access to system still gets the database they connected to.
• Grid: a label opens one row per node with <id>, <labels> and one column per property; a relationship type shows <id>, <start>, <end> and its properties. Sort and every filter operator become Cypher. A <labels> filter matches when any label does, BETWEEN reads both bounds, REGEX reads the value as text. Read-only in this PR.
• A grid page always runs in Bolt read mode, so a raw filter cannot write.
• Editor: Cypher runs as typed, with $1, $2 for the host's parameters. The row cap pulls cap + 1 records and discards the rest on the server.
• Export pulls 1,000 records at a time instead of holding the whole result.
• Stop sends RESET only to a user statement on the wire. A statement still waiting for the connection is dropped before it is sent, and metadata work holding the connection finishes.
• A statement the classifier proves a read goes out in Bolt read mode (.neo4j is in enginesWithProvenReads), so the server refuses a write the classifier missed.
• Safe Mode reads Cypher as the server does: \uXXXX escapes are decoded before tiering, and a DELETE with no WHERE, LIMIT or property map gets the dangerous-query confirmation. CREATE, MERGE, SET, REMOVE, DELETE, FOREACH and a procedure not known to read are writes, DROP is destructive, LOAD CSV reaches outside the database.
• Grammar: a withoutDashComments fact for Cypher, so (a)-- (b) stays code and the ; after it still splits.
• TLS uses the SSL settings in the form; Preferred connects without TLS when the TLS attempt fails. URLs with neo4j, neo4j+s, neo4j+ssc, bolt, bolt+s and bolt+ssc work: +s sets Verify Identity, +ssc sets Required.
• SSH tunnel works like other network plugins. neo4j:// connects to the host it names and does not follow a cluster routing table.

Docs: TableProApp/docs#142, to merge after this one.

Test plan

• swift test: TableProNeo4jCoreTests (39, including BETWEEN bounds, every <labels> operator, REGEX as text, the nesting limit), TableProSQLGrammarTests (272), TableProPluginKitTests (625).
• Unit plan: every suite in TableProTests/Core/Utilities/SQL (814, including Cypher unicode escapes, the unfiltered DELETE, the -- split), PluginDriverAdapterStatementContextTests, ConnectionURLParserTLSPortTests, PluginMetadataRegistryTypeCountTests, SQLLexicalFeatureMappingTests.
• scripts/probes/check-neo4j.sh against neo4j:5 (5.26.32), 40 checks: read mode refuses a write, a raw filter cannot write, BETWEEN and <labels> filters, a 2,500-row export in 3 batches, a queued statement cancelled while a count holds the connection, SSL Preferred against a server without TLS, and the server decoding \u0061bc outside a string.
• The same probe against neo4j:4.4 (4.4.48): 40 checks, Bolt 4 path with numeric ids and no LOGON.
• Neo4jDriverPlugin and KafkaDriverPlugin builds, verify-plugin-loads.sh, R1 and R2, check-plugin-provides.py, verify.sh l10n, and verify.sh lint on every changed Swift file.
• AllPlugins locally stops on the missing Dameng bridge library, with no Swift errors; CI builds it.
• Not rerun after the rewrite: the TLS-proxy checks with a self-signed certificate from the first round.

Fixes #1986