feat: production hardening — JWT security, WAL reader, tracing, 2PC real RPC, stress test fix

- JWT: getEffectiveJwtSecret() helper + warning log when not configured
- WAL: readEntries() with timestamp filter for PITR
- Tracing: core/tracing.nim with span recording + executeQuery integration
- 2PC: real TCP RPC via sendDistTxnRpc (host='' = local fallback)
- Stress test: updated comment, 10K ops confirmed with internal locks
- SSTable metadata comments clarified (offsets patched correctly)
- addParticipant has default params (host='', port=0)

src/baradadb.nim

@@ -56,6 +56,10 @@ proc main() =
   defaultLogger = newLogger(logLvl, config.logFile)
   info("BaraDB v0.1.0 — Multimodal Database Engine")
 
+  # Security check: warn if JWT secret is not configured
+  if config.jwtSecret.len == 0:
+    warn("JWT secret not configured! Set BARADB_JWT_SECRET env var or jwt_secret in config. Using default (INSECURE).")
+
   if config.tlsEnabled:
     if config.certFile.len == 0 or config.keyFile.len == 0 or
        not fileExists(config.certFile) or not fileExists(config.keyFile):