[TimelordUK]

Summary

Adds sockets(), the second system table (S2 in docs/SYSTEM_TABLES.md): every TCP and UDP socket on the machine with its owning pid, so it joins to processes().

WITH s AS (SELECT * FROM sockets()),
     p AS (SELECT * FROM processes())
SELECT s.*, p.name
FROM s INNER JOIN p ON s.pid = p.pid
WHERE p.user IS NOT NULL
ORDER BY started DESC
LIMIT 10;

• Fast. netstat -a is slow because it looks up a hostname for every address. sockets() never does: it reads the OS socket tables directly through netstat2 (GetExtendedTcpTable/GetExtendedUdpTable on Windows, netlink sock_diag + /proc/*/fd on Linux). About 6 ms for 204 sockets on Windows, 3 ms on Linux.
• Same columns everywhere: protocol, family, local_address, local_port, remote_address, remote_port, state, pid. One row per (socket, pid). A socket with no visible owner still gets a row, with a NULL pid.
• NULL instead of misleading values:
  • UDP and listening TCP sockets have no remote end, so the remote columns are NULL rather than 0.0.0.0 / 0.
  • Pid 0 is NULL. Windows uses 0 for sockets whose process has exited, and processes() lists pid 0 as Idle, so the join would otherwise blame the Idle process.
• TCP states use the standard RFC 793 names; Windows' DELETE_TCB maps to CLOSED.
• Behind the existing system-tables feature. Includes examples/system_sockets.sql (7 queries) and the S2 write-up.

Test plan

• cargo test --release on Windows 11: all pass. New tests open their own listener, connection and UDP socket and check each row; pid handling has its own unit test.
• Ubuntu 22.04 under WSL2: all 4 system tests pass, and it builds without libclang installed.
• Linux results checked against ss -tulpn as root and as a normal user.
• examples/system_sockets.sql passes via tests/integration/test_examples.py.
• cargo fmt --check, clippy clean for system.rs.
• --no-default-features --features redis-cache compiles. Plain --no-default-features already fails on main because of a RedisCache import in src/main_handlers.rs, unrelated to this PR.
• macOS not tested.

🤖 Generated with Claude Code