fix(storage): make cassandra index readiness probe actually wait

[lakhansamani]

Closes #803.

waitForCassandraSecondaryIndex existed to block startup until a ScyllaDB secondary index became queryable. Its probe was:

probe := fmt.Sprintf("SELECT id FROM %s.%s WHERE %s='' LIMIT 1 ALLOW FILTERING", keyspace, table, column)

ALLOW FILTERING is exactly the hint that lets Cassandra answer a query on a non-indexed column. The probe therefore succeeded whether or not the index existed, returned on its first attempt, and never waited for anything. All 13 call sites kept the startup race the helper was written to close — an intermittent index-unavailable error on the first query against a freshly provisioned keyspace.

waitForCassandraIndexes, added in #802 for the audit-log columns, already omitted the hint and carried a comment explaining why. This brings the other 13 in line.

Changes

• Drop the hint, so the probe fails until the index is ready. One line, but it makes 14 waits genuinely block for the first time.
• Consolidate all 17 probes into one call at the end of NewProvider, against a single 90s budget split per probe. This is the part that matters: left as 13 sequential 30s waits plus the audit-log wait, making them genuinely block turns a no-op into up to 13 × 30s = 6.5 min of serial startup delay. One shared budget bounds worst-case startup regardless of how many indexes are added later.
• Deferring to the end costs nothing: nothing inside NewProvider queries an indexed column, and the boot-time reserved-client seed runs in cmd/root.go:592, after the provider is constructed. Indexes created earliest also get the longest to settle before being probed.
• Hoist the list to cassandraIndexProbes and extract indexProbeQuery, so both are testable without a live cluster.

All 17 probed columns were confirmed to have a matching CREATE INDEX, so no probe can hang on a condition that is never satisfiable. Columns indexed as bigint (audit_log.created_at, session_token.expires_at, mfa_session.expires_at) are deliberately absent — the probe restricts on '', which only type-checks against a text column.

What the probe does and does not detect

It fails until the index schema propagates. For a fresh keyspace that is the same moment the (empty) index is usable, which is the race this closes.

It is not a view-build gate. An index added to a table that already holds rows answers the probe while its backfill is still running. Backfill readiness is system_distributed.view_build_status, deliberately not consulted here — a cold start must not block on a backfill it does not need. This is documented on the function so the fix is not mistaken for a guarantee that a filtered audit query is authoritative mid-backfill (see the #802 upgrade notes in CHANGELOG.md).

Testing

• TestIndexProbeQueryOmitsAllowFiltering — the regression guard. Confirmed it fails with the hint restored and passes without it, so it genuinely pins the bug.
• TestIndexProbesCoverAuditLogFilters — keeps the wait list in step with the columns ListAuditLogs filters on, and rejects duplicates (a duplicate would consume two shares of the budget).
• make test-scylladb against a cold ScyllaDB container: green, 25/25 storage subtest groups, 0 failures. internal/storage ran in 3.59s, so the now-blocking probes add no measurable startup cost on a fresh keyspace.
• go build ./..., go vet ./... clean.

make lint-go reports 4 pre-existing issues (1 gofmt in oauth_sso_verify_test.go, 3 reflect.Ptr govet inlining hints) that reproduce identically on main — local golangci-lint version drift, untouched here.