feat: support Windows/Kerberos integrated authentication

[egertaia]

Summary

Originally implemented integrated_auth as a discrete connection field plus
supports_integrated_auth capability on core (matching #775). While testing
end-to-end, @debba noted
that #775 was superseded by TabularisDB/tabularis#780,
a smaller host-side hook: connection-modal.extra_fields gains
credentialFieldsHidden / setCredentialFieldsHidden, and the flag itself
travels through the host's existing opaque extra map instead of a new
core field. This PR rebuilds the plugin side on top of that:

• mssql-tds-preview's default sspi/gssapi features enabled (was
  default-features = false) and AuthMethod::Integrated mapped when
  integrated_auth is set.
• New ui/: a Vite+React IIFE bundle (per PLUGIN_GUIDE.md's UI
  Extensions section) contributing the "Use Windows Authentication"
  checkbox to connection-modal.extra_fields, gated to driver: "sqlserver"
  via the manifest. Writes extra.integrated_auth and calls
  setCredentialFieldsHidden; degrades gracefully (checkbox works, login
  inputs just stay visible) on a host without that hook.
• ConnectionParams gains extra: HashMap<String, String>;
  resolve_connection_params resolves integrated_auth from
  extra["integrated_auth"] == "true" or from Integrated Security=True /
  Trusted_Connection=True in connection_string — either source rejects a
  combined username/password.
• Fixed build_connection_key: it never folded auth mode into the pool
  cache key, so editing a saved connection between SQL and Windows auth
  could reuse a stale pool built under the previous credentials.
• .tabularium: dropped the now-unused supports_integrated_auth
  capability, added the ui_extensions entry.
• README: documents the checkbox as a UI extension instead of a discrete
  connection field; also accepts the Command Timeout keyword as a
  client-side no-op (needed for real ADO.NET/SSMS-style connection strings).

Companion host PR: TabularisDB/tabularis#780

Test plan

• cargo test — 213 tests passing (connection.rs, pool_manager.rs, driver/pool.rs)
• cargo clippy --all-targets -- -D warnings — clean
• cargo fmt --check — clean
• ui/: npm run typecheck and npm run build — clean, produces a valid IIFE bundle exposing __tabularis_plugin__
• Manually verified end-to-end against a real domain-joined SQL Server via a Windows build (pnpm tauri dev on #780's branch + this plugin installed): checkbox appears from the plugin's own UI extension, connects via SSPI with no username/password, same as SSMS
• Not covered by CI: Linux/macOS GSSAPI path (needs a Kerberos KDC; only SSPI was live-tested)

[debba]

Thanks for this, the connection-string handling and the mssql-tds feature switch are exactly what was needed.

I made some changes on top of your branch to move the UI part into the plugin instead of core: the "Use Windows Authentication" checkbox is now a plugin UI extension on the connection-modal.extra_fields slot, the flag is read from the host's opaque extra map (extra.integrated_auth) as well as from Integrated Security=True in connection strings, and the supports_integrated_auth capability goes away. The matching host change is TabularisDB/tabularis#780.

Tomorrow I will look at how best to integrate this with your work here (most likely as a follow-up on top of this PR) and I will keep you posted. A live SSPI re-test on your side once that lands would be very welcome.