P3: Add config validation and best practice fixes

[ajianaz]

Summary

Cora scan found 18 best-practice issues. Most are about missing validation — config values accepted without semantic checks, typos in config silently ignored, and doc/API inconsistencies.

Key Issues

Config values accepted without validation (#94 — src/config/schema.rs:343)

Free-form strings/numbers (provider, base_url, temperature, max_tokens, timeout, cache_ttl) merged without validation. Invalid values propagate to runtime.

Fix: Add validation step after deserialization.

Profile values unvalidated (#81 — src/engine/profiles.rs:58)

Focus weights documented as 1-10 but any u32 accepted. Actions documented as block/warn but any string accepted.

Fix: Validate ranges and enums after parsing.

deny_unknown_fields missing (#80 — src/engine/profiles.rs:145)

Misspelled YAML keys silently dropped. Config appears to work but settings are ignored.

Fix: Add #[serde(deny_unknown_fields)] to config structs.

Unknown category actions treated as blocking (#57 — src/engine/quality_gate.rs:215)

Typos like Warn or blok silently become blocking failures.

Fix: Use enum deserialization for action values, case-insensitive.

Quality gate ignores enabled flag (#58 — src/engine/quality_gate.rs:147)

evaluate() can return Fail even when enabled is false.

Fix: Short-circuit when disabled.

Test contains stray eprintln (#44 — src/engine/rules/mod.rs:440)

Debug output in tests adds noise to CI logs.

Fix: Remove or gate behind debug flag.

review.context_chain not merged (#93 — P1, also noted here)

Documented in P1 bugs issue.

Additional minor items

• GitLab/Gitea webhook server (optional) #10: Format parsing allocates lowercase string
• crates.io publish #11: Severity counts scan issues 4x
• fix: use ~/.cora/ as config directory #23: DB size assumes 4096-byte page
• fix: remove self-hosted docs page #30: Debt snapshot save failures silently ignored
• perf: remove unused deps + replace deprecated serde_yaml #48: Serialized issue_type field name inconsistent
• fix: hardcoded Infisical ID + branding footer on no-issues (#62) #66: Ignore pattern matching overly permissive
• release: v0.1.4 #68: Token estimation returns 0 for short content
• 🔒 Security: Auth file permission not validated on read #72: Java wildcard imports truncated
• 🔒 Security: Git diff arguments not separated with -- #73: Rust module declarations not extracted
• 🔒 Security: No TLS certificate configuration for corporate proxies #74: Documented import path doesn't exist
• 📝 ProgressStyle::with_template().unwrap() in production #87: Test-file detection matches test substring
• 📝 AGENT.md mentions config validate but command does not exist #88: Early max_findings cutoff can drop higher-severity findings

Effort estimate: 1 day for P3-core (#94, #81, #80, #57, #58), rest ongoing