fix: peer review — 5 correctness bugs across who, db, lock, embedding, main

Comprehensive peer code review identified and fixed the following:

1. who.rs: @-prefixed path routing used `target` (with @) instead of
   `clean` (stripped) when checking for '/' and passing to Expert mode,
   causing `lore who @src/auth/` to silently return zero results because
   the SQL LIKE matched against `@src/auth/%` which never exists.

2. db.rs: After ROLLBACK TO savepoint on migration failure, the savepoint
   was never RELEASEd, leaving it active on the connection. Fixed in both
   run_migrations() and run_migrations_from_dir().

3. lock.rs: Multiple acquire() calls (e.g. re-acquiring a stale lock)
   replaced the heartbeat_handle without stopping the old thread, causing
   two concurrent heartbeat writers competing on the same lock row. Now
   signals the old thread to stop and joins it before spawning a new one.

4. chunk_ids.rs: encode_rowid() had no guard for chunk_index >= 1000
   (CHUNK_ROWID_MULTIPLIER), which would cause rowid collisions between
   adjacent documents. Added range assertion [0, 1000).

5. main.rs: Fallback JSON error formatting in handle_auth_test
   interpolated LoreError Display output without escaping quotes or
   backslashes, potentially producing malformed JSON for robot-mode
   consumers. Now escapes both characters before interpolation.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/main.rs

@@ -1217,7 +1217,12 @@ async fn handle_auth_test(
                 eprintln!(
                     "{}",
                     serde_json::to_string(&output).unwrap_or_else(|_| {
-                        format!(r#"{{"error":{{"code":"{}","message":"{}"}}}}"#, e.code(), e)
+                        let msg = e.to_string().replace('\\', "\\\\").replace('"', "\\\"");
+                        format!(
+                            r#"{{"error":{{"code":"{}","message":"{}"}}}}"#,
+                            e.code(),
+                            msg
+                        )
                     })
                 );
             } else {