feat(daemon): smart correlation state restoration during replay

[mostafa]

Summary

• Replace the blanket "skip state on any replay" heuristic with position-aware auto-restore. The daemon now tracks the NATS JetStream high-water mark (stream sequence + published timestamp) in SQLite alongside the correlation snapshot and compares the replay start point against it on restart: forward replay restores state (preserving cross-boundary correlation windows), backward replay skips state (avoiding double-counting).
• Add --keep-state / --clear-state as explicit operator overrides for cases where the automatic decision is not what you want.
• Wire --timestamp-fallback wallclock|skip to the CLI so forensic replay over logs without standard timestamp fields can opt into "detections only, no correlation updates."

Behavior matrix

Scenario	Old behavior	New behavior
Resume (default)	Restore	Restore (unchanged)
--replay-from-sequence N where N > stored	Skip	Restore (forward catch-up)
--replay-from-sequence N where N <= stored	Skip	Skip (unchanged)
--replay-from-time T where T > stored	Skip	Restore (forward catch-up)
--replay-from-time T where T <= stored	Skip	Skip (unchanged)
--replay-from-latest	Skip	Skip (unchanged)
--clear-state	Skip	Skip (unchanged)
--keep-state (new)	N/A	Restore (explicit override)
No stored position + any replay	Skip	Skip (unchanged, safe default)

Implementation

• AckToken::nats_stream_position() extracts (stream_sequence, published_unix_timestamp) from JetStream message metadata before acking.
• SourcePosition struct stored as source_sequence / source_timestamp INTEGER columns in SQLite (auto-migrated from old schema via PRAGMA table_info check).
• StateRestoreMode enum (Auto / ForceClear / ForceKeep) replaces the old clear_correlation_state: bool on DaemonConfig.
• decide_state_restore() encapsulates the full decision tree, testable in isolation.
• High-water mark tracked via AtomicU64 / AtomicI64 in the ack task, read by the periodic and shutdown state savers.
• --timestamp-fallback wired through build_correlation_config to set TimestampFallback::Skip on the CorrelationConfig.

Test plan

• 5 unit tests for SqliteStateStore (round-trip with/without position, position updates, old schema migration, empty DB)
• 10 unit tests for decide_state_restore (ForceClear, ForceKeep, Resume, Latest, forward/backward/equal sequence, forward/backward time, no stored position)
• cargo clippy --workspace --all-targets --all-features -- -D warnings clean
• cargo clippy --workspace --all-targets -- -D warnings clean (without NATS feature)
• Existing NATS integration + E2E tests still pass
• Manual: daemon with --state-db, shut down, restart with --replay-from-sequence above stored position, verify state restored
• Manual: same with sequence below stored position, verify state cleared