fix: derived-state determinism, error visibility, metrics naming, HTTP hardening

- rebuild: fold observations per fingerprint in a total order
  (hcl DESC, node_id DESC, id DESC) so two nodes with identical logs
  rebuild identical entries (was: arbitrary bare-column row, merge-order
  dependent)
- threads: CreateThreadCluster uses INSERT OR IGNORE + existing-id
  fallback — concurrent auto-threaders converge instead of hitting UNIQUE
- errors surfaced instead of swallowed: scanEntries returns rows.Err(),
  Stats() fails fast on query errors, AutoLinkThreadObservations /
  linkTemporalNeighbors / golden-thread linking propagate failures,
  AddThreadNote + LinkObservationToThread write under one tx,
  watch records session upsert failures
- gossip client: push checks HTTP status and reports errors (a broken
  push direction no longer looks like a silent success); gossip diff
  gets a 10s timeout so a dead peer cannot hang the CLI
- ingest: failed source sweeps (obsidian/browser/gitea) are logged,
  and -d's help text now states its file-only scope
- watch --quiet: fatal errors go to stderr instead of io.Discard
- main: cobra SilenceErrors/SilenceUsage (errors print once, usage is
  not dumped on runtime failures); knox mcp exits 0 on SIGINT/SIGTERM
- metrics: drop _total suffix from gauges (knox_observations,
  knox_entries, knox_projects, knox_sessions, knox_peers, knox_threads);
  _total stays on counters per Prometheus convention
- http: ReadHeaderTimeout + IdleTimeout on gossip, metrics, and web servers

tests: concurrent cluster-create idempotency, HCL-order rebuild fold
(both merge orders), push HTTP-error surfacing; full suite + -race pass,
gofmt clean

internal/metrics/metrics.go

@@ -59,14 +59,14 @@ func New(kdb *db.KnoxDB, nodeName string) *Metrics {
 	m.obsPushedTotal = newCounter(reg, "knox_gossip_observations_pushed_total", "Observations sent to peers.")
 	m.errorsTotal = newCounter(reg, "knox_gossip_errors_total", "Gossip errors (ping/pull/push failures).")
 
-	m.observationsGauge = newGaugeVec(reg, "knox_observations_total", "Observation log size.", "source_id")
+	m.observationsGauge = newGaugeVec(reg, "knox_observations", "Observation log size.", "source_id")
 	m.observationsLast24h = newGauge(reg, "knox_observations_last_24h", "Observations collected in the last 24h.")
-	m.entriesGauge = newGauge(reg, "knox_entries_total", "Materialized entry cache size.")
-	m.projectsGauge = newGauge(reg, "knox_projects_total", "Distinct projects in the entry cache.")
-	m.sessionsGauge = newGauge(reg, "knox_sessions_total", "Sessions tracked.")
+	m.entriesGauge = newGauge(reg, "knox_entries", "Materialized entry cache size.")
+	m.projectsGauge = newGauge(reg, "knox_projects", "Distinct projects in the entry cache.")
+	m.sessionsGauge = newGauge(reg, "knox_sessions", "Sessions tracked.")
 	m.pendingReflections = newGauge(reg, "knox_pending_reflections", "Sessions awaiting reflection.")
-	m.peersGauge = newGauge(reg, "knox_peers_total", "Known peer nodes.")
-	m.threadsByStatus = newGaugeVec(reg, "knox_threads_total", "Threads by status.", "status")
+	m.peersGauge = newGauge(reg, "knox_peers", "Known peer nodes.")
+	m.threadsByStatus = newGaugeVec(reg, "knox_threads", "Threads by status.", "status")
 	m.byOriginNode = newGaugeVec(reg, "knox_observations_by_node", "Observations per originating node.", "node_id")
 	m.knowledgeVector = newGaugeVec(reg, "knox_knowledge_max_hcl", "Highest HCL seen per originating node.", "node_id")
 

internal/metrics/metrics_test.go

@@ -79,7 +79,7 @@ func TestMetricsScrape(t *testing.T) {
 	out := string(body)
 	for _, want := range []string{
 		`knox_node_info{name="testnode"`,
-		`knox_observations_total{source_id="git"} 2`,
+		`knox_observations{source_id="git"} 2`,
 		`knox_gossip_pulls_total 0`,
 		"go_goroutines",
 		"process_cpu_seconds_total",