feat: add per-connection read-only mode

Connections default to read-only. SQL editor wraps queries in a
read-only transaction so PostgreSQL rejects mutations. Data mutation
commands (update_row, insert_row, delete_rows) are blocked at the
Rust layer. Toolbar toggle with confirmation dialog lets users
switch to read-write. Badges shown in workspace, table viewer, and
status bar.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src-tauri/src/commands/connections.rs

@@ -68,6 +68,9 @@ pub async fn delete_connection(
         pool.close().await;
     }
 
+    let mut ro = state.read_only.write().await;
+    ro.remove(&id);
+
     Ok(())
 }
 
@@ -102,6 +105,9 @@ pub async fn connect(state: State<'_, AppState>, config: ConnectionConfig) -> Tu
     let mut pools = state.pools.write().await;
     pools.insert(config.id.clone(), pool);
 
+    let mut ro = state.read_only.write().await;
+    ro.insert(config.id.clone(), true);
+
     Ok(())
 }
 
@@ -138,5 +144,28 @@ pub async fn disconnect(state: State<'_, AppState>, id: String) -> TuskResult<()
     if let Some(pool) = pools.remove(&id) {
         pool.close().await;
     }
+
+    let mut ro = state.read_only.write().await;
+    ro.remove(&id);
+
     Ok(())
 }
+
+#[tauri::command]
+pub async fn set_read_only(
+    state: State<'_, AppState>,
+    connection_id: String,
+    read_only: bool,
+) -> TuskResult<()> {
+    let mut map = state.read_only.write().await;
+    map.insert(connection_id, read_only);
+    Ok(())
+}
+
+#[tauri::command]
+pub async fn get_read_only(
+    state: State<'_, AppState>,
+    connection_id: String,
+) -> TuskResult<bool> {
+    Ok(state.is_read_only(&connection_id).await)
+}