The permission registry: every permission, code role and scope key the
enabled modules declare or derive. Built once at boot as
`:wagoe/permission-registry`; nothing outside it can be granted.

The database port: what a database adapter must provide.

Lived at `wagoe.platform.ports.database` until BOU-303,
which is where a port cannot live — every module's persistence layer had to
reach into platform's shell to name it, and `.wagoe/check-ports.edn` carried
the 20 sites that did as its largest burn-down entry.

Unlike the router abstraction ADR-037 removed, this seam is real: four
adapters implement it (postgresql, mysql, sqlite, h2), and the differences
between them — dialect, boolean representation, JDBC URL shape — are exactly
what the methods below name.

For executing queries rather than describing a database, see
`wagoe.platform.database`.

Protocol defining the common interface for database adapters.

This protocol abstracts database-specific behavior while allowing 
common database operations to be implemented in a shared core namespace.
Each database type (SQLite, PostgreSQL, MySQL, H2) implements this 
protocol to provide database-specific functionality.

Design Philosophy:
- Keep protocol narrow - prefer common behavior in core
- Only include methods that differ between databases
- Database-agnostic operations belong in core namespace
- Type conversions use shared utilities where possible

The HTTP server port.

Routing is not a port: modules emit Reitit route data and the platform
compiles it (ADR-037). The server is — a Ring handler is handed to whatever
implements this protocol.

Data export (GDPR Art. 20) and retention, contributed per module.

A module implements `IDataExporter` for the data it owns and contributes it
under `:data-export` in its `ig-config`; `IRetentionPolicy` likewise under
`:retention`. Platform collects both, so no module reads another's tables.