FFI drops all error detail: open returns bare NULL, operations return bare -3 — add nodedb_last_error

[emanzx]

Summary

The FFI has no error-detail surface. nodedb_open returns NULL for every failure mode, and operations report a bare status code (-3 for almost everything). An embedder cannot distinguish failures that need very different handling. Requesting a nodedb_last_error (or equivalent) export.

Checked on origin/main @ ee9ccdd: no error-detail export exists in nodedb-lite-ffi.

What happens

• nodedb_open returns NULL for: wrong passphrase, corrupt store, bad path, runtime construction failure, invalid UTF-8 passphrase. All indistinguishable — yet "wrong passphrase" should prompt the user again, "corrupt store" should trigger recovery policy, and "bad path" is a programming error.
• Operational exports return NODEDB_ERR_FAILED (-3) for SQL syntax errors, unknown collections, engine rejections, serde failures, and internal errors alike. The embedder sees the same -3 for "typo in SQL" and "storage layer failed".

Why it matters

Every binding on top of this FFI ends up surfacing "operation failed" with no detail, and users debug by bisecting their input. The information exists inside the library at the point of failure; it is dropped at the FFI boundary.

Suggested change

A minimal, allocation-friendly shape, following the existing string convention:

// Returns the message for the most recent failure on this handle (or a
// process/thread-level slot for open failures), as a string the caller
// frees with nodedb_free_string. NULL when no error is recorded.
char *nodedb_last_error(void *handle);

Thread-local storage for the message keeps it race-free without locks. Even a coarse first cut (store the Display of the error that produced the last non-OK status) would remove most of the guesswork.