Production-readiness papercuts (bundle)

Severity: low/medium (bundle of independent papercuts).

Small hardening items, grouped to avoid issue sprawl. Each is independent.

- **Internal error details leak to clients.** `Status::internal(format!("… {e:?}"))` forwards Debug-formatted `DatabaseError` (SQLite strings, pool/path info) to callers (`crates/node/src/node/grpc/mod.rs:199,259,308,321`). Log server-side, return generic statuses.
- **Stats runs unauthenticated full-table scans.** `get_stats` does `COUNT(*)` + `COUNT(DISTINCT tag)` on every call (`crates/node/src/database/sqlite/mod.rs:216-232`), exposed to anyone (`grpc/mod.rs:313-330`). Cache/rate-limit it; note per-tag counts are also a privacy consideration. (`notes_per_tag` is also declared in the proto but returned empty — `grpc/mod.rs:326` `// TODO`.)
- **Health/reflection sit behind the global concurrency limit + 4 s timeout** (`grpc/mod.rs:117-125`), so probes queue/fail exactly when the service is saturated. Layer limit/timeout on the app service only.
- **Concurrency-limit / timeout ordering** (`grpc/mod.rs:121-122`): the timeout is *inside* the concurrency limit, so once 4096 permits are exhausted, new requests queue with no timeout. Move the timeout outside, or use `LoadShed` to reject rather than queue. Also, tower timeout errors surface as transport errors, not `DEADLINE_EXCEEDED`.
- **IPv6 bind can't be expressed.** `format!("{host}:{port}").parse::()` (`grpc/mod.rs:111-113`) fails for `--host ::`. Parse host as `IpAddr` and use `SocketAddr::new`.
- **No env-var config.** clap args have no `env=` fallback (`bin/node/src/main.rs:11-39`); several operationally important knobs are hardcoded (maintenance interval, poll interval, batch size, pool size). Add `env` fallbacks and promote the important knobs to flags.
- **Startup log omits version/commit** (`bin/node/src/main.rs:52-62`); expose `CARGO_PKG_VERSION` at startup and as a build-info metric.
- **Broken doc link:** `docs/src/operator/installation.md` links `./usage.md#bootstrapping`, which doesn't exist.
- **No end-to-end smoke test in CI.** `build-docker.yml` builds with `push: false` and stops; no workflow runs the image and does a health + send/fetch round-trip. (Distinct from #75 load testing.)
- **`max_connections` is misnamed** — it configures request concurrency, not TCP connections or live streams (`grpc/mod.rs:62-63,121`). Rename or actually enforce a connection cap.

---
Part of #114.