docs: document the in-place primary/replica role switch

[jovfer]

Summary

Documents the QuestDB Enterprise hot in-place primary/replica role switch,
shipped in 3.3.3 (questdb-enterprise#1024),
together with the SWITCH ROLE permission and node_role() from 4.0.0
(questdb-enterprise#1108)
and the demote-refusal semantics from 4.0.0
(questdb-enterprise#1109).
Nothing in the docs mentioned any of it before.

New pages:

• query/sql/switch-role.md: SWITCH ROLE TO PRIMARY | REPLICA [TIMEOUT ms] and SWITCH STATUS, result columns, timeout semantics, statement errors, permissions. Sibling of the SWITCH COLD STORAGE ROLE page.
• high-availability/failover.md: the operator guide. Planned switchover, promotion after a primary loss, choosing the timeout, refusals and the UNKNOWN state, restarts, what each client protocol sees during a demote, and the GET /lifecycle and POST /lifecycle/switch endpoints.

Updated pages:

• query/functions/meta.md: node_role().
• security/rbac.md: SWITCH ROLE in the permissions table, a failover operator scenario, the built-in admin's break-glass role in a replicated cluster.
• high-availability/setup.md, overview.md, client-failover/concepts.md: the migration procedures now point at the in-place switch; the restart-based flow is kept for older versions and the emergency migration is marked as the lossy path.
• configuration/database-replication.md: replication.role is the boot role, the restart hazard after a switch, the primary-catchup-uploads value.
• configuration/http-min-server.md, operations/logging-metrics.md: the endpoints served on port 9003, GET /lifecycle (which OSS serves too), http.health.check.authentication.required, and the questdb_replication_pending_upload_txn and questdb_backup_active_at_last_demote gauges.
• configuration/http-server.md, operations/backup.md, operations/upgrade.md, troubleshooting/error-codes.md, enterprise-kubernetes-operator/high-availability.md: small additions, listed in the changelog.

Every behaviour is verified against the 4.0.0 code (questdb-enterprise 282a809a0) rather than the PR descriptions. Three statements in #1024's description turned out to be wrong and are documented as the code behaves: the HTTP /exec refusal is 403, not 400; ILP over HTTP answers 421 not accepting writes, not SECURITY_ERROR; and ILP over TCP does not disconnect on a demote but silently drops rows until a refusal reaches the connection.

Two warnings are new and come from reading the code, since no test restarts a node after an in-place switch: a demoted node restarted with a stale replication.role=primary can pass the ownership check and come up as a second primary, and a promoted node restarted with replication.role=replica silently demotes itself. Both are printed as :::danger on the failover page and on replication.role.

For review:

• The Kubernetes Operator note states that the operator cuts over by re-rolling pods and does not use the in-place switch (operator issue Updated OWNED BY doc #96). Wording to confirm with the operator team.
• node_role is missing from questdb/sql-parser functions.ts; separate PR.
• Neither questdb-enterprise#1024 nor #1108 has a release-notes entry.

[github-actions]

🚀 Build success!

Latest successful preview: https://preview-533--questdb-documentation.netlify.app/docs/

Commit SHA: 223f053

📦 Build generates a preview & updates the link on each commit.