refactor(config): validate eagerly at startup and remove Result from runtime config methods

Refactors configuration validation to fail fast on fatal errors at startup
while gracefully handling recoverable issues (e.g., malformed whitelist entries).

Changes:
- Add Config::validate() for eager validation called immediately after load
- Remove Result<> from archive_config() and repository_config() methods
- WhitelistEntry::parse_whitelist() skips invalid entries with warnings
- Validate relay_owner_nsec format in Config::validate()
- Update all call sites to remove Result handling from config getters

Benefits:
- Fatal config errors (incompatible settings) fail at startup, not runtime
- Recoverable errors (bad whitelist entries) logged as warnings and skipped
- No Result handling scattered throughout runtime code after validation
- Config methods safe to call without error handling after validate()

Testing:
- Add 7 new tests for validation edge cases and error handling
- Total config tests: 40 (up from 33)
- All 320 library tests passing

Breaking change: Config users must call config.validate() after Config::load()
to ensure configuration is valid. This is enforced in main.rs.

2 files changed, 19 insertions, 27 deletions

diff --git a/src/nostr/builder.rs b/src/nostr/builder.rs
index 10f7648..9819e37 100644
--- a/src/nostr/builder.rs
+++ b/src/nostr/builder.rs
@@ -567,26 +567,24 @@ pub async fn create_relay(
     // Clone Arc for the write policy so both relay and policy can access the database
     let git_data_path = config.effective_git_data_path();
 
-    // Parse and log archive configuration
-    if let Ok(archive_config) = config.archive_config() {
-        if archive_config.enabled() {
-            tracing::info!(
-                "GRASP-05 archive mode enabled: archive_all={}, whitelist_entries={}, read_only={}",
-                archive_config.archive_all,
-                archive_config.whitelist.len(),
-                archive_config.read_only
-            );
-        }
+    // Log archive configuration (config.validate() must be called at startup)
+    let archive_config = config.archive_config();
+    if archive_config.enabled() {
+        tracing::info!(
+            "GRASP-05 archive mode enabled: archive_all={}, whitelist_entries={}, read_only={}",
+            archive_config.archive_all,
+            archive_config.whitelist.len(),
+            archive_config.read_only
+        );
     }
 
-    // Parse and log repository configuration
-    if let Ok(repository_config) = config.repository_config() {
-        if repository_config.enabled() {
-            tracing::info!(
-                "Repository whitelist enabled: whitelist_entries={}",
-                repository_config.whitelist.len()
-            );
-        }
+    // Log repository configuration
+    let repository_config = config.repository_config();
+    if repository_config.enabled() {
+        tracing::info!(
+            "Repository whitelist enabled: whitelist_entries={}",
+            repository_config.whitelist.len()
+        );
     }
 
     // Create write policy with purgatory integration
diff --git a/src/nostr/events.rs b/src/nostr/events.rs
index 3ec075d..3b4ef25 100644
--- a/src/nostr/events.rs
+++ b/src/nostr/events.rs
@@ -400,15 +400,9 @@ pub fn validate_announcement(
         Err(e) => return AnnouncementResult::Reject(format!("Invalid announcement: {}", e)),
     };
 
-    // Get archive and repository configs (fail-secure: reject on config errors)
-    let archive_config = match config.archive_config() {
-        Ok(c) => c,
-        Err(e) => return AnnouncementResult::Reject(format!("Config error: {}", e)),
-    };
-    let repository_config = match config.repository_config() {
-        Ok(c) => c,
-        Err(e) => return AnnouncementResult::Reject(format!("Config error: {}", e)),
-    };
+    // Get validated configs (config.validate() must be called at startup)
+    let archive_config = config.archive_config();
+    let repository_config = config.repository_config();
 
     let npub = announcement.owner_npub();
     let lists_service = announcement.lists_service(&config.domain);