fix: prevent write loss during block rotation and harden WAL recovery

[zhourrr]

Fix a crash-recovery data loss window where rotating a full block could delete the WAL containing a newly logged operation before applying it. Rotate the block before appending the next operation.

Harden WAL recovery by:

• Validating the entire log before replay, including document payloads and predecessor IDs.
• Recording explicit predecessors for new upserts and supporting legacy upsert recovery.
• Distinguishing corruption from incomplete crash tails and preserving valid records.
• Enforcing read-only access and consistent WAL reader/writer state.