Fix audit findings: CB race, silent billing zeros, config/SSE robustness

[jaredLunde]

Addresses issues surfaced by the technical audit of the gateway.

Correctness / data integrity

• Windowed circuit-breaker race (circuit_breaker.rs) — the old two-atomic design (state + window_start) computed the window-reset decision outside the state CAS. Concurrent failures landing at a window boundary could each independently reset the count to 1 and clobber one another, pinning the count and leaving a genuinely-broken provider's breaker stuck closed. Fixed by anchoring the failure window in the packed timestamp so reset-and-increment commit in a single CAS; the redundant window_start atomic is removed. New test_concurrent_windowed_counts_every_failure regression test (200 iterations × 20 threads).
• Silent zero-token billing rows (proxy.rs) — a managed 2xx response whose usage block fails to parse (provider wire change, new API version) emitted a 0-token ai.usage row indistinguishable from a real zero. Now increments ai_usage_parse_errors_total and logs a warn! for alerting. The zero-token row stays (correct sentinel); the observability gap is closed.
• CRLF SSE line endings (usage.rs) — data: lines split on \n retained a trailing \r (valid per RFC 8895), failing the JSON parse and silently zeroing usage. Now trims both ends.

Operability / security

• upstream_verify_cert=false boot warning (state.rs) — disabling cert verification is a transparent-MitM opening valid only for the local test mock; now warns loudly at boot so it can't be a silent production misconfig.
• Malformed-TOML attribution (config.rs) — a syntax error in the operator's config was swallowed and resurfaced as an opaque Figment error; now fails the load with the file named.

Performance

• record_success fast path (circuit_breaker.rs) — early-return on an already-clean breaker so high-throughput success traffic to one provider doesn't bounce its breaker cache line on every response.

Minor

• half_open_permits(1) so the breaker matches ARCHITECTURE.md's documented "a probe is admitted".
• Corrected an inaccurate comment on the "stream" pre-filter needle (peek.rs).
• Kept ARCHITECTURE.md Metrics table in sync.

Verification

All CI checks pass locally: dprint check, cargo fmt --check, cargo clippy --all-targets -D warnings, cargo test --lib (98), cargo test --test '*' (21), cargo build --release with -D warnings.

🤖 Generated with Claude Code