pgbouncer-0001 (CWE-312 SCRAM verifier logged at slog_debug) was already documented.
pgbouncer-0002: find_database() uses statlist_for_each + strcmp O(D) on every new
client connection login path. find_global_user() uses aatree_search O(log U) but
DB lookup was never upgraded. Fix: AA-tree or hash index mirroring user_tree pattern.
100x op-count at D=100, 1000x at D=1000. Test PASS. MOADs 0002/0003/0005 CLEAN.
