Feat v0.7.11 query & HTTP ergonomics

Add four new Starlark sandbox builtins to reduce extension friction
around SQL decomposition and synchronous HTTP fan-out:

- db.count(table, filters) — integer row count
- db.aggregate(table, column, op, filters) — single-value aggregation
- db.query_batch(queries) — up to 10 query specs in one call
- http.batch(requests) — concurrent dispatch of up to 10 HTTP requests

Extract buildSelectQuery helper from dbQuery for reuse by query_batch.
21 new tests (14 db, 7 http). No new permissions or schema changes.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docs/STARLARK-REFERENCE.md

@@ -117,6 +117,25 @@ tables = db.list_tables()
 
 Available views: `users`, `channels`.
 
+#### Aggregate operations
+
+```python
+# Count rows matching filters
+count = db.count("tasks", filters={"status": "open"})
+
+# Aggregate a column (sum, avg, min, max, count)
+total = db.aggregate("orders", "amount", "sum", filters={"status": "paid"})
+# Returns int, float, or None (if no matching rows)
+
+# Batch multiple queries in a single call
+results = db.query_batch([
+    {"table": "tasks", "filters": {"status": "open"}, "limit": 10},
+    {"table": "logs", "order": "-created_at", "limit": 5},
+])
+# Returns list of result lists. Max 10 queries per batch.
+# Each query spec supports: table (required), filters, order, limit, before, after, search_like
+```
+
 #### Write operations
 
 ```python
@@ -154,6 +173,18 @@ Response dict:
 }
 ```
 
+#### Batch requests
+
+```python
+responses = http.batch([
+    {"method": "GET", "url": "https://api.example.com/a"},
+    {"method": "POST", "url": "https://api.example.com/b", "body": "{}", "headers": {"Content-Type": "application/json"}},
+])
+# Returns list of response dicts (same shape as individual calls).
+# Individual failures return {"status": 0, "body": "error: ...", "headers": {}}.
+# Max 10 requests per batch. Dispatched concurrently.
+```
+
 **Security:**
 - Private/loopback IPs are blocked (SSRF protection).
 - Packages can declare `network_access.allow` (allowlist) or