refactor(config): validate eagerly at startup and remove Result from runtime config methods

Refactors configuration validation to fail fast on fatal errors at startup
while gracefully handling recoverable issues (e.g., malformed whitelist entries).

Changes:
- Add Config::validate() for eager validation called immediately after load
- Remove Result<> from archive_config() and repository_config() methods
- WhitelistEntry::parse_whitelist() skips invalid entries with warnings
- Validate relay_owner_nsec format in Config::validate()
- Update all call sites to remove Result handling from config getters

Benefits:
- Fatal config errors (incompatible settings) fail at startup, not runtime
- Recoverable errors (bad whitelist entries) logged as warnings and skipped
- No Result handling scattered throughout runtime code after validation
- Config methods safe to call without error handling after validate()

Testing:
- Add 7 new tests for validation edge cases and error handling
- Total config tests: 40 (up from 33)
- All 320 library tests passing

Breaking change: Config users must call config.validate() after Config::load()
to ensure configuration is valid. This is enforced in main.rs.

1 files changed, 8 insertions, 1 deletions

diff --git a/src/main.rs b/src/main.rs
index 8b959a6..a6f1d9d 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -28,7 +28,14 @@ async fn main() -> Result<()> {
     // Load configuration (priority: CLI flags > env vars > .env file > defaults)
     let config = Config::load()?;
 
-    info!("Configuration loaded: {}", config.bind_address);
+    // Validate configuration and fail fast on fatal errors
+    // Recoverable issues (e.g., malformed whitelist entries) are logged as warnings
+    config.validate()?;
+
+    info!(
+        "Configuration loaded and validated: {}",
+        config.bind_address
+    );
     info!("Domain: {}", config.domain);
     info!("Relay name: {}", config.relay_name());
     info!("Git data directory: {}", config.effective_git_data_path());