feat: implement persist_recover with snapshot load and WAL replay (P0-4)

- Add load_snapshot(): reads P0 sentinel ("XCESNAP\0" + lsn), validates magic,
  extracts checkpoint_lsn
- Add replay_wal(): scans seg-*.wal files in LSN order, skips entries <= from_lsn,
  verifies CRC chain, stops on mismatch, applies entries via apply_wal_entry() stub
- Add persist_recover(): find latest .capnp snapshot, load it, replay post-checkpoint
  WAL, retention pass (no-op in P0)
- Fix trim_wal_segments(): compare against active segment start LSN (not checkpoint_lsn)
  to avoid deleting the currently-open segment and losing post-checkpoint WAL entries
- Add restore_job() stub in job.c (P0-12a placeholder)
- Add worker_from_capnp() stub in worker.c (P0-12 placeholder)
- Declare both new functions in cluster.h and worker.h
- Add 5 recovery tests: empty state, snapshot lsn loading, WAL replay, corrupt
  sentinel rejection, latest-snapshot selection; all 23 controller tests pass

src/controller/testsuite/controller_test.c

@@ -9,6 +9,7 @@ extern void test_persist_types(void);
 extern void test_persist_wal(void);
 extern void test_persist_schema(void);
 extern void test_persist_checkpoint(void);
+extern void test_persist_recovery(void);
 
 void setUp(void) { return; }
 
@@ -87,6 +88,7 @@ int main(int argc, char* argv[])
     TEST(test_persist_wal);
     TEST(test_persist_schema);
     TEST(test_persist_checkpoint);
+    TEST(test_persist_recovery);
 
     return UNITY_END();
 }