fix: resolve all 55 identified bugs across the codebase

Comprehensive bug fix pass across all subsystems:
- Critical: lexer infinite loop, WAL lock discipline, checkpoint safety,
  compaction verification, HMAC key truncation, healthCheck leak
- High: MVCC lock safety, B-Tree delete rebalancing, Raft stale term
  handling, replication socket leaks and ack cleanup, sharding migration
  with old assignments, 2PC recovery, JWT/SCRAM auth fixes, wire protocol
  bounds checks
- Medium: config error handling, MERGE parser completeness, IR/codegen
  correctness, UDF bounds checks, LIMIT cost accuracy, mmap safety
- Low: timeout handling, float parsing edge cases, uint32 truncation,
  cache entry cleanup

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/barabadb/query/ast.nim

@@ -229,8 +229,11 @@ type
       mergeSourceAlias*: string
       mergeOn*: Node
       mergeMatchedUpdate*: seq[Node]  # SET assignments, empty if no UPDATE
+      mergeMatchedDelete*: bool       # WHEN MATCHED THEN DELETE
+      mergeMatchedCondition*: Node    # optional AND <condition> after MATCHED
       mergeNotMatchedInsert*: seq[Node]  # column list for INSERT
       mergeNotMatchedValues*: seq[Node]  # value expressions for INSERT
+      mergeNotMatchedNothing*: bool   # WHEN NOT MATCHED THEN DO NOTHING
     of nkCreateType:
       ctName*: string
       ctBases*: seq[string]
@@ -404,6 +407,7 @@ type
       funcName*: string
       funcArgs*: seq[Node]
       funcFilter*: Node
+      funcDistinct*: bool
     of nkTypeCast:
       castType*: string
       castExpr*: Node