[Feature] Query cost/complexity guard — block expensive queries before execution

[mosw]

Add the ability to reject queries that would be too expensive or resource-intensive. Examples:

SELECT * FROM large_table without LIMIT
Cartesian joins (cross joins on large tables)
Queries touching more than N tables
Nested subqueries beyond a configured depth

This prevents an agent from accidentally running a query that locks up the database or racks up cloud costs, even if the query isn't technically "destructive."