Upgrade rollup

[johnny-emp]

Summary

Rolls the currently open upgrade PRs into one branch:

• Harden secure-mode authorization coverage #22 Harden secure-mode authorization coverage
• Add P2 test coverage for storage safety paths #23 Add P2 test coverage for storage safety paths
• Improve API ergonomics and error codes #24 Improve API ergonomics and error codes
• P1: Split large API and test modules #25 P1: Split large API and test modules
• Fail closed on corrupted KV reads #26 Fail closed on corrupted KV reads
• docs: tighten production readiness claims #27 docs: tighten production readiness claims
• Add production tooling gates #28 Add production tooling gates

Merge-resolution notes

• Preserved the API/test module split while carrying forward secure-mode and corruption tests that were added to the old monolithic test file.
• Kept secure-mode public no-auth backup/read APIs fail-closed.
• Made permission-denied display text generic while preserving structured error variants.
• Revalidated full-backup WAL tail selection when checkpoint-covered WAL files are reclaimed during backup setup.
• Updated the naming-gate violation in src/commit/apply.rs with a domain-specific binding name.

Verification

• cargo fmt --check
• cargo test