Cassandra: ExtendDB w/Cassandra uses plain-text between ExtendDB server and Cassandra node #472

The ExtendDB server connects to a Cassandra backend plain TCP only (i.e. no TLS). There is currently no option to enable TLS, so the application credentials and all item data cross the network in clear text. This is acceptable only on a trusted, isolated network. Surfaced in the docs PR (#412) review; the docs now state the limitation, and this issue tracks adding encryption.

cdrs-tokio is declared with features = ["derive"] and no TLS feature (Cargo.toml:68). The ExtendDB engine builds the session with NodeTcpConfigBuilder + TcpSessionBuilder (crates/storage-cassandra/src/engine.rs) which results in a the plaintext connection. There is no config key to enable encryption.

Mitigation involves:

• Dependency change. cdrs-tokio's TLS is a Cargo feature (rust-tls) that pulls in rustls and a different node config builder (NodeRustlsConfigBuilder), requiring a rustls::ClientConfig.
• Second engine path. engine.rs needs a TLS branch that builds the session via the rustls config builder when TLS is configured, leaving the existing plaintext path as the default.
• New config surface. A [storage.cassandra.tls] block: enable flag, CA bundle path, optional client certificate (for mutual TLS), and a verify mode.
• Test infrastructure. devtools/cassandra-node starts a plaintext node; verifying this needs a TLS-enabled node (server cert, and the client trusting it), which we don't set up today.

Proposed approach:
- Add an optional [storage.cassandra.tls] config block; absent = plaintext (unchanged default, so local dev is untouched).

• When present, enable the cdrs-tokio TLS feature and build the session through NodeRustlsConfigBuilder with a rustls::ClientConfig assembled from the configured CA / client cert / verify mode.
• Mirror the PostgreSQL sslmode story in the config and docs (CA bundle, verify-full equivalent).
• Extend devtools/cassandra-node (or add a sibling) to start a TLS node for the integration test, and add a test that connects over TLS.

Done when:

• A [storage.cassandra.tls] config enables an encrypted connection to a TLS-enabled Cassandra node, verified by an integration test.
• Plaintext remains the default when the block is absent (local dev unchanged).
• docs/cassandra-setup.md and docs/manuals/11-deployment-guide.md are updated to document the TLS option and drop the current "unencrypted, trusted network only" caveat (or scope it to the plaintext default).