fix: derived-state determinism, error visibility, metrics naming, HTTP hardening

- rebuild: fold observations per fingerprint in a total order
  (hcl DESC, node_id DESC, id DESC) so two nodes with identical logs
  rebuild identical entries (was: arbitrary bare-column row, merge-order
  dependent)
- threads: CreateThreadCluster uses INSERT OR IGNORE + existing-id
  fallback — concurrent auto-threaders converge instead of hitting UNIQUE
- errors surfaced instead of swallowed: scanEntries returns rows.Err(),
  Stats() fails fast on query errors, AutoLinkThreadObservations /
  linkTemporalNeighbors / golden-thread linking propagate failures,
  AddThreadNote + LinkObservationToThread write under one tx,
  watch records session upsert failures
- gossip client: push checks HTTP status and reports errors (a broken
  push direction no longer looks like a silent success); gossip diff
  gets a 10s timeout so a dead peer cannot hang the CLI
- ingest: failed source sweeps (obsidian/browser/gitea) are logged,
  and -d's help text now states its file-only scope
- watch --quiet: fatal errors go to stderr instead of io.Discard
- main: cobra SilenceErrors/SilenceUsage (errors print once, usage is
  not dumped on runtime failures); knox mcp exits 0 on SIGINT/SIGTERM
- metrics: drop _total suffix from gauges (knox_observations,
  knox_entries, knox_projects, knox_sessions, knox_peers, knox_threads);
  _total stays on counters per Prometheus convention
- http: ReadHeaderTimeout + IdleTimeout on gossip, metrics, and web servers

tests: concurrent cluster-create idempotency, HCL-order rebuild fold
(both merge orders), push HTTP-error surfacing; full suite + -race pass,
gofmt clean

internal/cmd/gossip.go

@@ -2,6 +2,7 @@ package cmd
 
 import (
 	"fmt"
+	"time"
 
 	"github.com/david/knox/internal/db"
 	"github.com/david/knox/internal/watch"
@@ -77,7 +78,7 @@ func NewGossipCmd(kdb *db.KnoxDB) *cobra.Command {
 // gossipDiff compares this node's observation log + auto-threads with a peer's
 // via /v1/diff. Never writes; it is the preview for what a sync would adopt.
 func gossipDiff(kdb *db.KnoxDB, peerAddr string) error {
-	c := &watch.Client{Addr: peerAddr}
+	c := &watch.Client{Addr: peerAddr, Timeout: 10 * time.Second}
 	remote, err := c.Diff()
 	if err != nil {
 		return err

internal/cmd/ingest.go

@@ -97,6 +97,8 @@ func NewIngestCmd(kdb *db.KnoxDB) *cobra.Command {
 					for _, r := range results {
 						record(r)
 					}
+				} else {
+					log.Printf("[knox] obsidian ingest failed: %v", err)
 				}
 			}
 			log.Printf("[knox] ingesting browser-history...")
@@ -104,12 +106,16 @@ func NewIngestCmd(kdb *db.KnoxDB) *cobra.Command {
 				for _, r := range results {
 					record(r)
 				}
+			} else {
+				log.Printf("[knox] browser-history ingest failed: %v", err)
 			}
 			log.Printf("[knox] ingesting gitea...")
 			if results, err := ingest.NewGiteaIngester().IngestAll(); err == nil {
 				for _, r := range results {
 					record(r)
 				}
+			} else {
+				log.Printf("[knox] gitea ingest failed: %v", err)
 			}
 
 			fmt.Printf("\nIngest complete: %d new entries, %d updated\n", totalNew, totalUpdated)

internal/cmd/watch.go

@@ -1,8 +1,10 @@
 package cmd
 
 import (
+	"fmt"
 	"io"
 	"log"
+	"os"
 
 	"github.com/david/knox/internal/db"
 	"github.com/david/knox/internal/watch"
@@ -25,7 +27,10 @@ func NewWatchCmd(kdb *db.KnoxDB) *cobra.Command {
 			log.Printf("[knox] starting watcher, scanning %d directories", len(dirs))
 			w := watch.New(kdb, dirs)
 			if err := w.Start(); err != nil {
-				log.Fatalf("watcher error: %v", err)
+				// Not log.Fatalf: --quiet redirects the logger to io.Discard,
+				// so a fatal exit must reach the user on stderr directly.
+				fmt.Fprintf(os.Stderr, "watcher error: %v\n", err)
+				os.Exit(1)
 			}
 		},
 	}