fix: crash-proofing + small robustness fixes

- pool.js: add pool.on('error') handler — an idle-client error (DB restart /
  .215 failover) previously crashed the process (no 'error' listener → throw)
- context tool: project a SAFE_COLUMNS allow-list for resources (never the
  monitoring/metadata JSON blobs); also add 'resource' to TABLE (was unhandled)
- applyPendingChange: guard the 'upsert' arm so a non-upsertable entity_type
  fails with a clear ValidationError instead of a bare TypeError

Tests: pool_error, context (resource case), pending_extended_actions (guard).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

lib/api/routes/pending_changes.js

@@ -35,6 +35,9 @@ export async function applyPendingChange(row, actor) {
       return created.id;
     }
     case 'upsert': {
+      if (typeof repo.upsertByExternal !== 'function') {
+        throw new ValidationError(`entity_type '${row.entity_type}' does not support upsert`);
+      }
       const row_ = await repo.upsertByExternal(row.payload, actor);
       return row_.id;
     }