libsql-server: make namespace creation all-or-nothing (stacked on #51)

[tszymczyszyn-shopify]

Summary

Stacked on #51 (targets tszymczyszyn/streaming-dump-importer; will be retargeted to v0.9.30-shopify-patches once #51 merges — only the last two commits are this PR).

Makes POST /v1/namespaces/:ns/create all-or-nothing. Fixes the pre-existing lifecycle gap called out in #51's design doc §13: a dump that failed to import left a ghost namespace (config without data, name unusable, lazily turned into an empty DB on first access); a request cancelled mid-import ran no cleanup at all; the schema configurator had no cleanup even on error.

Design: docs/ATOMIC_NAMESPACE_CREATE_DESIGN.md.

Contract (new, documented in ADMIN_API.md)

After a non-2xx or a lost connection the namespace is either absent (no config, no directory, name reusable) or complete — never partial. For callers: 2xx ⇒ complete; anything else ⇒ retry; already exists on the retry ⇒ the earlier attempt did complete.

How

The metastore write becomes the commit point; everything before it is reversible.

create(name, restore, config)
├─ Reservation::acquire(name)        lock cache entry; reject if loaded or config exists
├─ handle(); store(cfg, flush=false) in-memory only — setup can read it, nothing on disk
├─ configurator.discard_incomplete   remove dbs/<name> iff it carries `.incomplete`
├─ make_namespace(...)               setup: FreshDir::begin → mkdir + marker … import … keep()
├─ handle.flush()                    ◄── COMMIT POINT
├─ ns.mark_complete()                remove marker (best effort)
└─ reservation.publish(ns)           entry := Some(ns); lock released
     Err/drop above   ⇒ Reservation::drop ⇒ remove in-memory config, THEN release lock
     Err/drop in setup ⇒ FreshDir::drop   ⇒ remove_dir_all

• Reservation generalises the pattern fork already used (write-lock the cache entry, config in memory only, flush on success). Dropping it unpublished — error or cancellation — removes the config on the blocking pool and releases the lock only afterwards, so waiters see "doesn't exist", never a half-built namespace. fork now uses it too; its old guard used block_in_place (panics on a current-thread runtime) and published before flushing.
• FreshDir removes a brand-new directory on drop unless keep()-ed; primary and schema configurators.
• .incomplete marker for crashes: written with the directory, removed after the flush; consulted in exactly one place (create, for a name with no config and nothing loaded) so it can never wipe a published namespace; maybe_recover_from_fs skips marked dirs. Marker-less directories keep today's semantics.
• Requests addressed to a namespace under creation wait (as during fork/reset).
• Needs async-lock = "3" for RwLock::write_arc — already in the lockfile; the bump removes the duplicate 2.x.

Behaviour changes visible to clients

• Failed create ⇒ GET …/config is 404 and user requests get "namespace doesn't exist" (was: 200 / "no such table").
• Single-namespace mode: create default from a dump while it exists ⇒ already exists (was: 200 with the dump silently skipped). The config-upsert behaviour of a plain create default is unchanged.

Tests

• 9 new lifecycle tests + 2 tightened cancellation tests (both importers); 9 of the 11 fail on the unfixed code, the other two pin behaviour that must hold before and after (requests wait; unmarked dirs untouched).
• Unit tests for FreshDir (incl. drop of the enclosing future) and discard_incomplete.
• Full libsql-server suite under nextest: identical results to the base branch (local_sync_with_writes and the wall-clock-ratio replica_no_resync_on_restart fail under parallel load on both; both pass alone).

Known limitation (inherited, documented)

If moka evicts the locked cache entry during a multi-minute import, a concurrent request can lazily open the directory being written. reset/fork have the same exposure today; the fix is an in-flight-operations map outside the cache — separate change.