v0.25.0 — operational foundation pt.2: unified config + resilience (dependency-light)

Second slice of the WS-007 operational foundation — both behind neutral, dependency-light seams.

Unified configuration (#93)

• A stdlib-only config seam: Source + Load binding config:"KEY" struct tags from flags > env > file > default, with typed parsing (string/int/bool/float/duration). Built-in sources: env, flags, dotenv, JSON, map.
• Canonical ServerOptions (GRPC/HTTP addr, log level, OTLP endpoint, DSN); the scaffold loads these instead of hardcoding.
• Adapter config/koanf isolates YAML/TOML (+ koanf) — core stays stdlib-only.

Resilience (#94)

• resilience policy interceptors with the algorithm behind an interface: TimeoutUnary (per-RPC deadline → DeadlineExceeded; 30s default, NoTimeout to disable, per-method override), RateLimitUnary (RateLimiter interface + stdlib token bucket → ResourceExhausted; off by default), and a CircuitBreaker seam + interceptor documented for plugging a lib — no breaker library baked into core.
• Wired into the default chain: rate-limit early (load-shed), breaker outside the handler, timeout innermost.

Hardening (#104)

• Fixed DotEnv silent truncation on scanner error; fixed a dead scaffold flag layer (generated -GRPC_ADDR/etc. overrides now actually work — matches the README); corrected precedence docs. -race + cleancore guard green.

Dependency-light gate: core gains no heavy dep — koanf confined to config/koanf, token bucket is stdlib, no circuit-breaker lib in core (enforced by cleancore_test.go).