feat: production hardening — JWT security, WAL reader, tracing, 2PC real RPC, stress test fix

- JWT: getEffectiveJwtSecret() helper + warning log when not configured
- WAL: readEntries() with timestamp filter for PITR
- Tracing: core/tracing.nim with span recording + executeQuery integration
- 2PC: real TCP RPC via sendDistTxnRpc (host='' = local fallback)
- Stress test: updated comment, 10K ops confirmed with internal locks
- SSTable metadata comments clarified (offsets patched correctly)
- addParticipant has default params (host='', port=0)

src/barabadb/storage/lsm.nim

@@ -134,9 +134,9 @@ proc writeSSTable*(entries: seq[Entry], path: string, level: int): SSTable =
   s.write(SSTableVersion)
   s.write(uint32(entries.len))
   let indexOffsetPos = s.getPosition()
-  s.write(0'u64)  # indexOffset placeholder
+  s.write(0'u64)  # patched after data+bloom are written
   let bloomOffsetPos = s.getPosition()
-  s.write(0'u64)  # bloomOffset placeholder
+  s.write(0'u64)  # patched after data+bloom are written
 
   # Write data block
   var offsets = newSeq[(string, int64)](entries.len)

src/barabadb/storage/wal.nim

@@ -84,3 +84,39 @@ proc close*(wal: var WriteAheadLog) =
 
 proc entryCount*(wal: WriteAheadLog): uint64 = wal.entryCount
 proc path*(wal: WriteAheadLog): string = wal.path
+
+proc readEntries*(walPath: string, untilTimestamp: uint64 = 0): seq[WalEntry] =
+  result = @[]
+  if not fileExists(walPath): return
+  let s = newFileStream(walPath, fmRead)
+  if s == nil: return
+  # Skip header
+  var magic: uint32
+  var version: uint32
+  discard s.readData(addr magic, 4)
+  discard s.readData(addr version, 4)
+  if magic != WALMagic: return
+  while not s.atEnd:
+    var kind: uint8
+    if s.readData(addr kind, 1) != 1: break
+    var timestamp: uint64
+    if s.readData(addr timestamp, 8) != 8: break
+    if untilTimestamp > 0 and timestamp > untilTimestamp:
+      break
+    var keyLen: uint32
+    if s.readData(addr keyLen, 4) != 4: break
+    var key = newSeq[byte](keyLen)
+    if keyLen > 0:
+      if s.readData(addr key[0], int(keyLen)) != int(keyLen): break
+    var valLen: uint32
+    if s.readData(addr valLen, 4) != 4: break
+    var value = newSeq[byte](valLen)
+    if valLen > 0:
+      if s.readData(addr value[0], int(valLen)) != int(valLen): break
+    result.add(WalEntry(
+      kind: WalEntryKind(kind),
+      timestamp: timestamp,
+      key: key,
+      value: value,
+    ))
+  s.close()