I went back to using the router on my bench for testing. I turned down the TX power on the router thinking I was oversaturating the ESP at such a close distance. I switched to channel 6, which is less populated in my neighborhood, and played with orientation of the ESP and the router. Then I cut away more of the perfboard under the antenna. Now I am seeing ~1.5Mb/s upload and ~3.5Mb/s download, with a few runs hitting 4.4Mb/s.

During those runs, the driver on the Pi reports a link quality of 62/70 and -48dBm signal level and a 54Mbit connection. Interestingly enough, OpenWRT on the router shows the TX (to the router) as fluctuating between 22 and 62Mbit/s while RX seems stuck at 2Mbit/s.

While that's still not good performance, it's more evidence that SDIO isn't the bottleneck.

I probed the 3.3V on the ESP-03 module's bypass cap, and there's about 300mVp-p ripple when pushing traffic, which isn't worrisome. While I was poking around I noticed that the ESP-03 has only one cap on 3.3V, while the Espressif guideline is 3 caps: 10uF, 1uF, and 0.1uF. There's not enough room to probe at the chip pads, but I wouldn't be surprised if it's uglier.

I also saw that the antenna signal from the chip goes from the pin to a via, through a couple of right turns, through another via, and doubling back to the pad on the capacitor. I'm no RF guru, but I know enough that I'm not surprised this isn't working well.