Move native startup services into atomic_lib and separate HTTP lifetime

[joepio]

The native app currently boots a full hosted-server adapter to access its local data. This PR begins removing that dependency: native storage opening, persisted identity loading and durable flushing now live in atomic_lib::runtime, and HTTP serving has its own lifetime.

• Add AtomicNode::open_local, load_or_create_agent and an owned start_durable_flush guard. They run on plain Tokio without an HTTP origin, atomic-server or Actix. The hosted adapter consumes those same services instead of maintaining its own identity/flush implementations.
• Preserve identities across restart and config-only recovery, including the initial drive. Reuse the core legacy-secret migration. Damaged existing config returns an error rather than silently replacing the identity.
• Separate serve::run_node from serve::serve_http, preserving serve and the managed-node serve_with_hook API. Tauri receives its native handle before HTTP starts and keeps the runtime alive after the HTTP adapter stops.
• Remove the server config type from the tray. Update the runtime plan and coverage map with the remaining dependency-removal gates.
• Add a standalone native-runtime CI gate after the workspace tests: reject atomic-server/Actix dependencies in the core graph and compile/test with only db-redb,config, outside workspace feature unification.

Remaining migration: Tauri still depends on atomic-server/Actix for configuration, plugin/bootstrap services and the current frontend's local HTTP/WS transport. No no-HTTP user setting is exposed. Native frontend reads/commits/events, attachment access, shared plugin services and ownership of the process-global Iroh lifetime remain. The end-state acceptance gate explicitly requires the default Tauri dependency graph to contain neither atomic-server nor Actix, plus desktop restore/offline/sync acceptance with no listener bound.

Related issues: #1196 (local-first SDK/API), #749 (origin independence). Related native-binding work: #1277 and #1241. These broader issues are not closed by this PR.

Validation on macOS:

• 4 standalone native tests pass: originless signed creation + restart, retained-config recovery, legacy secret compatibility, damaged-config preservation. The core dependency gate passes; its rejection path was also checked with an injected Actix dependency listing.
• 3 core runtime tests pass, including final flush/database reopen and ingest-policy regressions.
• 67 server unit tests pass with --no-default-features, matching the Tauri server dependency.
• 2 HTTP-optional integration tests pass: native CRUD/events despite an occupied HTTP port, and hosted ready-hook ordering.
• Existing WebSocket GET and commit/isolation regressions: 3 pass, 2 pre-existing GET tests ignored.
• cargo check -p atomic-server-tauri passes. Compile-only frontend stub; no desktop UI or Windows acceptance claimed.
• Native-core clippy completes with existing warnings outside the changed runtime files. Formatting and diff checks pass. Dagger TypeScript syntax and shell syntax checked; the standalone gate ran locally, but Dagger itself was not run locally.
• No frontend source/catalog changes; reused frontend assets for Rust tests (ATOMICSERVER_SKIP_JS_BUILD=true).