fix: resolve all 55 identified bugs across the codebase

Comprehensive bug fix pass across all subsystems:
- Critical: lexer infinite loop, WAL lock discipline, checkpoint safety,
  compaction verification, HMAC key truncation, healthCheck leak
- High: MVCC lock safety, B-Tree delete rebalancing, Raft stale term
  handling, replication socket leaks and ack cleanup, sharding migration
  with old assignments, 2PC recovery, JWT/SCRAM auth fixes, wire protocol
  bounds checks
- Medium: config error handling, MERGE parser completeness, IR/codegen
  correctness, UDF bounds checks, LIMIT cost accuracy, mmap safety
- Low: timeout handling, float parsing edge cases, uint32 truncation,
  cache entry cleanup

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/barabadb/query/lexer.nim

@@ -164,6 +164,8 @@ type
     tkDatabases
     tkUse
     tkShow
+    tkDo
+    tkNothing
 
     tkAutoIncrement
     tkSequence
@@ -377,6 +379,8 @@ const keywords*: Table[string, TokenKind] = {
   "dst": tkDst,
   "merge": tkMerge,
   "matched": tkMatched,
+  "do": tkDo,
+  "nothing": tkNothing,
   "array": tkArray,
   "vector": tkVector,
   "document": tkDocument,
@@ -516,6 +520,8 @@ proc readNumber(l: var Lexer, startLine, startCol: int): Token =
     numStr.add(l.input[l.pos])
     discard l.advance()
   if isFloat:
+    if numStr.endsWith("."):
+      numStr.add("0")
     Token(kind: tkFloatLit, value: numStr, line: startLine, col: startCol)
   else:
     Token(kind: tkIntLit, value: numStr, line: startLine, col: startCol)
@@ -529,6 +535,7 @@ proc readIdent(l: var Lexer, startLine, startCol: int): Token =
       fastRuneAt(l.input, l.pos, run, true)
       ident.add($run)
       inc l.col
+      discard l.advanceRune()
     else:
       break
   let lowerIdent = ident.toLower()