fix: 5 bugs found during integration testing

[MauricioPerera]

Summary

• auth: role assign no awaita operación y verify retorna roles obsoletos del JWT #1 auth role assign: await added to assignRole()/removeRole() — fixes empty stdout
• index create --sorted flag ignored: always creates hash index #2 sorted index: Pass { type: 'sorted' } to createIndex() instead of { sorted: true } — fixes --sorted flag being ignored
• vec import fails with vec export output: format mismatch #3 vec import/export: importOp now accepts { exported, records } wrapper from exportOp, not just bare arrays
• vec store-batch drops metadata: reads 'meta' instead of 'metadata' #4 store-batch metadata: Read rec["metadata"] (with rec["meta"] fallback) instead of only rec["meta"] — fixes metadata loss in batch inserts
• aggregate $unwind does not strip $ prefix from field name #5 $unwind: Strip leading $ from field name before passing to js-doc-store unwind() — fixes arrays not being flattened

Test plan

• 264/264 existing tests pass
• 12/12 new fix verification tests pass (all 5 fixes confirmed)
• Build succeeds with tsup

Closes #1, #2, #3, #4, #5

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request enhances database and vector command handlers by ensuring asynchronous role operations are awaited, refining the $unwind aggregation stage to handle leading $ prefixes, and updating index creation to specify types. It also improves batch operations by supporting a metadata field and allowing wrapped record arrays in imports. Feedback highlights the need to apply similar await fixes to the logout sub-command and suggests extending the $unwind logic to handle object-based path definitions.

[gemini-code-assist]

Adding await here is correct as these operations are asynchronous and must complete before the handler returns to ensure the response is accurate and errors are caught.

Note that the same issue appears to exist in logoutSub (lines 136 and 138 in the full file), where auth.logoutAll() and auth.logout() are called without await. You should consider applying the same fix there to ensure consistent behavior and proper error handling during logout.

[gemini-code-assist]

The fix for $unwind correctly handles the string shorthand by stripping the leading $. However, if the underlying library supports the object form of $unwind (e.g., {$unwind: { path: '$field', preserveNullAndEmptyArrays: true }}), this implementation will pass the object directly to pipe.unwind() with a string cast, and the leading $ inside the path property will remain.

If the object form is supported, you should also strip the $ from the path property within the object, similar to how it's handled in the $group stage (lines 214 and 233).