Changes

* There is no cross-DC replication; if the DC goes down, the cluster becomes unavailable and we might have to restore from S3.

* All sharding logic and management lives in a stand-alone "db router" process, so that it's transparent to the webapp code.

There's a commercial software product called "ScaleBase" that implements much of this functionality off the shelf. We should start there, but keep in mind the possibility of a custom dbrouter process.