refactor: split action/mod.rs + worker/event/autocomplete test coverage

[killertux]

Summary

Addresses all high-leverage and most medium-priority findings from the recent architectural review.

High-leverage (3/3)

• src/action/mod.rs split — 3074 → 1594 lines (48% reduction) via 5 cohesive submodules: action::update, action::session, action::query, action::schema, action::results. Each handles one domain end-to-end; mod.rs stays the dispatch entry point with pub re-exports preserving the existing API (action::flush_session, action::schedule_session_save, action::try_promote_pending_update).
• Worker tests — Added 9 tests to src/worker/mod.rs covering the previously untested infrastructure boundary: clean exit on Close, clean exit on command-channel drop, no-connection guards (Cancel / Reset / Execute / Introspect), Connect-failure surfacing, sqlite Connect + Execute + Reload smoke test that also asserts SchemaCache mutation.
• Event overlay × screen tests — Added 9 App-backed integration tests in src/event.rs covering modal-stack interactions: Help-over-Normal, Command-over-modal, Connecting-swallows-all-keys (but Ctrl+C still quits), ConfirmRun / UpdateAvailable / ConfirmToolUse bindings, mid-session overlay swap, conn-form screen routing, bracketed-paste overlay routing.

Medium

• Lock-ordering contract — Documented the Arc<RwLock<SchemaCache>> ordering rules in src/app.rs: worker writes / main reads, never held across .await, never nested with another lock.
• llm/tools.rs split — Extracted all() schema vector + function_tool() builder into src/llm/tools/schemas.rs. tools.rs: 1638 → 1392 lines; prompt-engineering surface is now isolated from dispatch logic.
• Autocomplete edge-case tests — Added 9 parameterized tests to src/autocomplete/context.rs for the review's gap list: subquery-in-FROM, subquery-in-JOIN, scalar subquery in projection, UNION / EXCEPT / INTERSECT binding scope, three-way join, chained CTEs, PostgreSQL "Quoted" identifiers, MySQL backtick identifiers.

Skipped — with reasoning

• state/schema.rs split. Re-read the file: 882 lines = ~440 prod + ~440 tests. SchemaPanel is one cohesive abstraction; visible_rows() traverses the tree directly via nodes[].children, so there's no clean tree/view seam. Splitting into two structs would force touching every app.schema.<field> call site across action/, event/, ui/ for marginal cohesion gain. Deferred — not worth the churn.

Version

Bumped patch: 0.16.2 → 0.16.3.

Test plan

• cargo test --bin rowdy — 603 passed (was 575 before this branch).
• cargo clippy --all-targets --no-deps — clean.
• All extractions verified cargo check clean after each step (no half-built intermediate states left in the branch).
• Smoke-run the binary against a real database to confirm no behavioral drift (purely mechanical extractions, but worth eyeballing the schema panel, results expand/yank, and chat-tool dispatch).