An authenticated connection’s identity. Bound at connect time and consulted
on every query by dispatch_query to enforce the user’s role: a
readonly principal may only execute read statements.
Fixed reader-permit pool. Read-only autocommit statements take one permit;
writers, sync operations, and explicit transactions take the entire pool.
Tokio’s fair semaphore queue prevents a waiting writer from being starved by
later readers.