feat(server): FIFO channels data plane (PUSH/POP/GET_CHAN_LEN) (PR 2)

[ortuman]

Summary

Builds the FIFO data plane on top of PR 1's transition slice. Owners now PUSH elements to a FIFO channel; JOINed read-allowed members atomically POP them; owners query the queue depth with GET_CHAN_LEN.

The load-bearing contract: each POP advances and fsyncs the head cursor sidecar before writing POP_ACK. A crash between cursor fsync and the socket write loses that element consumer-side; no element is ever returned by two POP_ACKs. PUSH durability matches BROADCAST (synchronous flush when message_flush_interval == 0, batched otherwise). The cursor advance plus a tail-segment retention invariant in the message log keeps the seq counter recoverable across restart.

CLEAR (owner-driven drain / recovery) ships in a follow-up PR.

What changed

• Protocol (crates/protocol): 6 new variants — PUSH/PUSH_ACK, POP/POP_ACK, GET_CHAN_LEN/CHAN_LEN. PUSH and POP_ACK are payload-bearing (BROADCAST/MESSAGE framing convention). 7 round-trip tests.
• Channel manager (crates/server): Command::{Push,Pop,GetChannelLen} and matching handlers with the full error matrix (CHANNEL_NOT_FOUND, WRONG_TYPE, USER_NOT_IN_CHANNEL, FORBIDDEN, NOT_ALLOWED, QUEUE_EMPTY, QUEUE_FULL, POLICY_VIOLATION, CURSOR_RECOVERY_REQUIRED, NOT_IMPLEMENTED). QUEUE_FULL is gated by the logical cursor-to-tail depth, not the physical entry count. Adds PopVisitor next to the existing HistoryVisitor to capture a single entry into a pooled buffer.
• C2S dispatch (crates/server/src/c2s/conn.rs): wire the three new messages.
• Client (crates/client): push(channel, payload), pop(channel) -> (payload, timestamp), get_chan_len(channel) -> u32 on both compio and tokio C2S clients.
• Metrics (under the narwhal prefix): fifo_pushes{result}, fifo_pops{result} with one label per outcome, and fifo_cursor_fsync_seconds histogram. Skipped fifo_queue_depth (use GET_CHAN_LEN instead).
• Message::PopAck added to the send_message_with_payload payload-bearing variant assertion in crates/common.
• Docs: docs/PROTOCOL.md gains the six wire messages; docs/architecture/channels/fifo-channels.md status flipped to "Partially Implemented (CLEAR pending PR 3)". CHANGELOG entry.

Tests added

crates/server/tests/c2s_fifo_channel.rs grows by 12 tests:

• PUSH/POP roundtrip — payload and PUSH timestamp survive intact
• QUEUE_EMPTY on POP against an empty FIFO
• QUEUE_FULL via logical depth — fill cap, POP one, PUSH succeeds, PUSH again fails
• PUSH from non-owner returns FORBIDDEN
• POP from non-member returns USER_NOT_IN_CHANNEL
• POP from member excluded by read ACL returns NOT_ALLOWED
• GET_CHAN_LEN reflects PUSH/POP activity
• GET_CHAN_LEN from non-owner returns FORBIDDEN
• Competing consumers — two clients POPing the same FIFO each get a distinct element
• Cursor durable across restart — PUSH 3, POP 1, restart, POP remaining: consumed entry must not resurface
• POP force-flushes the log when the entry is not yet durable (60s message_flush_interval, POP still completes immediately)
• PUSH durable with message_flush_interval=0 — PUSH, shutdown, restart, POP returns the pre-restart payload

Test plan

• cargo fmt --all clean
• cargo clippy --workspace --all-targets -- -D warnings clean
• cargo test --workspace passes (all 200+ tests, including the 12 new FIFO data-plane tests plus the 11 PR 1 FIFO tests still green)
• Skim the PR for anything that should bypass the assertion change in crates/common/src/conn/mod.rs