#4063: Enable storage.debug flag to log go-leia performance issues (#4102)

When storage.debug is true, go-leia will log warnings for:
- Full table scans (no index used for query)
- Suboptimal index usage (index used but with low filter efficiency)

This helps developers and administrators identify missing indexes or
unoptimized queries that cause CPU/memory performance issues.

Also upgrades go-leia from v4.2.0 to v4.3.0 which adds the
QueryStatsCallbacks API needed for this feature.

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: reinkrul

README.rst

@@ -206,6 +206,7 @@ The following options can be configured on the server:
     pki.maxupdatefailhours                        4                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Maximum number of hours that a denylist update can fail
     pki.softfail                                  true                                                                                                                                                                                                                                                                                                                                                                                                                                                                     Do not reject certificates if their revocation status cannot be established when softfail is true
     **Storage**
+    storage.debug                                 false                                                                                                                                                                                                                                                                                                                                                                                                                                                                    When true, enables extra logging of storage-layer problems (e.g. performance issues).
     storage.session.memcached.address             []                                                                                                                                                                                                                                                                                                                                                                                                                                                                       List of Memcached server addresses. These can be a simple 'host:port' or a Memcached connection URL with scheme, auth and other options.
     storage.session.redis.address                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Redis session database server address. This can be a simple 'host:port' or a Redis connection URL with scheme, auth and other options. If not set it, defaults to an in-memory database.
     storage.session.redis.database                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         Redis session database name, which is used as prefix every key. Can be used to have multiple instances use the same Redis instance.
@@ -217,10 +218,10 @@ The following options can be configured on the server:
     storage.session.redis.sentinel.username                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Username for authenticating to Redis Sentinels.
     storage.session.redis.tls.truststorefile                                                                                                                                                                                                                                                                                                                                                                                                                                                                               PEM file containing the trusted CA certificate(s) for authenticating remote Redis session servers. Can only be used when connecting over TLS (use 'rediss://' as scheme in address).
     storage.sql.connection                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 Connection string for the SQL database. If not set it, defaults to a SQLite database stored inside the configured data directory. Note: using SQLite is not recommended in production environments. If using SQLite anyways, remember to enable foreign keys ('_foreign_keys=on') and the write-ahead-log ('_journal_mode=WAL').
+    storage.sql.rdsiam.dbuser                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Database username for IAM authentication. If not specified, the username from the connection string will be used. The database user must be created with IAM authentication enabled.
     storage.sql.rdsiam.enabled                    false                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Enable AWS RDS IAM authentication for the SQL database connection. When enabled, the node will use temporary IAM tokens instead of passwords. Requires the connection string to be a PostgreSQL or MySQL RDS endpoint without a password.
     storage.sql.rdsiam.region                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              AWS region where the RDS instance is located (e.g., 'us-east-1). Required when RDS IAM authentication is enabled.
-    storage.sql.rdsiam.dbuser                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Database username for IAM authentication. If not specified, the username from the connection string will be used. The database user must be created with IAM authentication enabled.
-    storage.sql.rdsiam.tokenrefreshinterval       14m0s                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Interval at which to refresh the IAM authentication token. RDS tokens are valid for 15 minutes, so the default is 14 minutes to ensure tokens are refreshed before expiry. Specified as Golang duration (e.g. 10m, 1h).
+    storage.sql.rdsiam.tokenrefreshinterval       14m0s                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Interval at which to refresh the IAM authentication token. RDS tokens are valid for 15 minutes, so set this to ensure tokens are refreshed before expiry. Specified as Golang duration (e.g. 10m, 1h).
     **Tracing**
     tracing.endpoint                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       OTLP collector endpoint for OpenTelemetry tracing (e.g., 'localhost:4318'). When empty, tracing is disabled.
     tracing.insecure                              false                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Disable TLS for the OTLP connection.