feat(horismos): configuration loading and validation (P2-02)

[forkwright]

Summary

• Creates crates/horismos/ with full config loading and validation implementation
• Figment cascade: compiled defaults → harmonia.toml → secrets.toml → HARMONIA__* env vars (double-underscore separator)
• 11 per-subsystem config structs (ExousiaConfig, ParocheConfig, TaxisConfig, EpignosisConfig, KritikeConfig, AggeliaConfig, ZetesisConfig, ErgasiaConfig, SyntaxisConfig, ProsthekeConfig, DatabaseConfig) with sensible defaults
• TaxisConfig includes HashMap<String, LibraryConfig> with WatcherMode and MediaType enums
• Startup validation: JWT secret (non-empty, not "changeme", ≥32 bytes), port range (≥1024), timeout values (>0), library path warnings (non-fatal)
• Secrets path derived as sibling to config file (secrets.toml)

Test results

17 tests, all passing:

• Default config values correct
• TOML overrides defaults
• Env vars override TOML
• secrets.toml is loaded
• Missing config file falls back to defaults
• JWT secret validation (empty, "changeme", too short, valid)
• Library path warnings (inaccessible → warn, accessible → no warn)
• Port validation rejects privileged ports
• Serialize/Deserialize roundtrip for Config, ExousiaConfig, TaxisConfig, DatabaseConfig, AggeliaConfig

Validation

cargo fmt --all -- --check  ✓
cargo clippy -p horismos -- -D warnings  ✓
cargo test -p horismos  ✓ (17/17)