feat(config): make startup bounds configurable

[EnRaiha]

A store written by another build failed every boot with a message that called its WAL segments corrupt. The reader already knew the format version and threw it away, which is the root cause. This branch surfaces that version, so startup names what it found and what it requires, and it makes the two startup bounds configurable with a test pinning each one.

What changed

Area	Change	Paths
WAL reader	Return WalError::UnsupportedVersion instead of flattening every header validation failure into StopReason::Corruption	nodedb-wal/src/reader.rs
Startup gate	Name the version, the segment, and whether the store needs a migration or a newer binary. A zeroed version takes the empty-tail path, so a torn write does not refuse a store that used to boot	nodedb/src/wal/manager/replay.rs
Startup bounds	Read raft_ready_timeout_ms and data_group_recovery_timeout_ms from [tuning.startup] as newtypes, and refuse them on the [server] path with the key named	nodedb-types/src/config/tuning/startup.rs, nodedb/src/config/server/config.rs, nodedb/src/bootstrap/cluster_ready.rs, nodedb/src/bootstrap/data_group_recovery.rs, nodedb/src/control/security/auth_lease/status.rs
Log line	The wrapper above the error no longer calls every validation failure corruption	nodedb/src/bootstrap/wal_init.rs
Boot order	Validate the WAL before the writer opens it. The writer's open recovers the newest segment, so without this the composed message was unreachable on the store that motivated the work	nodedb/src/bootstrap/wal_init.rs, nodedb/src/wal/manager/replay.rs
Tests	A version gap in a plaintext store and behind a preamble, a zeroed version, an empty tail, a record-less segment behind the tail, unframed bytes, and the bound a caller passes	nodedb/src/wal/manager/replay.rs, nodedb/src/bootstrap/cluster_ready.rs, nodedb/tests/inproc/

Why

A 20,000-row store booted in 83.4 s, and the phase that dominates the boot runs after both startup gates, so neither bound covers it. Both bounds were hard-coded and unreachable from the server config.

Separately, the production store could not boot at all, and the message sent its reader looking for damage that was not there. The header carried the answer.

Checks

• Formatting: cargo fmt --all -- --check passes.
• Focused tests: exit 0, the replay module and the error-class parity module.
• Mutation: with the reader's version error removed, exit 100, and exactly the version-message tests fail.
• Full library suite: 8,785 pass, 0 fail.
• End to end: a real version-1 production copy is refused with version compatibility: WAL segment '…' holds records in WAL format version 1; this build requires 3. The store needs a migration, not a repair., the word "corrupted" appears zero times in its log, and a real version-3 store boots to serving.

cargo nextest run -p nodedb --lib -E 'test(/wal::manager::replay/) or test(/class_parity/)'

Evidence, logs, the mutation diff and the end-to-end script: https://github.com/EnRaiha/nodedb/blob/pr412-c620167c/docs/review/README.md

Scope

Two units share this pull request, one commit each: the startup bounds under [tuning.startup], and the WAL format diagnosis. They are independent, and a reviewer who wants only one can take the commit that carries it. The third commit is two clippy fixes that CI's -D warnings profile requires.

Review 2: PASS, 0 blockers, bound to this head. The evidence branch, its logs and its tags are linked above.

A rebase merge keeps the unit commits separate. A squash merge would erase them, and the two commits that cover the reader test can be folded into one on request.

Closes #354

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.