The extraction pipeline shared by the in-VPC worker and the customer-side connector: streaming JDBC read, per-row masking, CSV, AES-256 zip. Deliberately free of JPA/AWS/messaging dependencies.