refactor: remove defensive/fallback code patterns (F09/F10/F11/F26/F27)

[rsecss]

Summary

Closes F09/F10/F11/F26/F27 from docs/.local/v1.0.0-audit-report.md §2.1 — the user's most-loathed defensive/fallback patterns. Establishes the invariant-at-boundary + log-don't-swallow baseline going into v0.7.0. Epic sub-branch #3 of 9.

Rules now codified

• Internal invariant violations → expect / unreachable!, never unwrap_or
• Boundary failures → explicit error propagation or log + handle, never let _ =
• No // future phases / // best-effort / // may hold state comments

F-id resolution

F-id	Where	What
F09	services/window.rs	Removed 2 let _ = &self; + future-phases comment. Deleted unreachable create_fallback_window. Renamed create_degraded_window → create_maximized_window with Why-comment for real Linux compositor / Windows monitor-disconnect recovery.
F10	services/tray.rs	show_main_window no longer silently swallows emit/unminimize via let _ =. Each step warns explicitly.
F11	pages/main/SettingsPage.svelte	catch (_) { /* best-effort */ } → named error path with [role=alert] banner. zh-CN/en i18n keys added.
F26	timer/state.rs + commands/mod.rs	Invariant work_duration > pre_alert_duration moved to config boundary (validate_timer_config). Internal .expect() with documented invariant.
F27	services/stat.rs	PR #27 already transactionalized v1→v2. Found and fixed remaining v0→v1 inconsistency: extracted to migrate_initial_to_v1 inside a single transaction with plain CREATE TABLE. v1→v2 keeps IF NOT EXISTS because user-restored-snapshot scenario is real and tested.

Bonus cleanup: silent let _ = in lib.rs (window.hide) and platform/windows.rs (CloseHandle) replaced with logged paths. 4 remaining let _ = cases each annotated with Why-comments (OnceCell race winner, watch::Sender no-receivers, Drop try_send/join_handle non-propagation).

Grep verification

Pattern	Before	After
catch (_) in src/	1	0
// future phases / may hold state in future	2	0
unwrap_or numeric-fallback at timer/state.rs	1	0
let _ = in src-tauri/src/	10	4 (all annotated)

Tests

• 3 new Rust config invariant tests: timer_config_accepts_defaults, timer_config_rejects_work_le_pre_alert, timer_config_accepts_work_just_above_pre_alert
• 1 new Svelte test: "surfaces error banner when both save and revert fail"
• 191 Rust passed (default + --no-default-features), 98 Svelte passed
• Coverage: 89% lines / 86.49% branches / 86.44% functions (above 80/70 gate from ci(coverage): add 80/70 frontend + 80% backend coverage gate #26)
• Local npm run ci 8/8 steps pass

Constraints honored

• ✅ No touches to platform/macos.rs or fullscreen toggle UI (sub-branch fix(release): sync Cargo.lock to v0.2.0 #5 territory)
• ✅ No backwards-compatibility shims
• ✅ CHANGELOG untouched (release sub-branch chore(task): archive migrate-to-github-flow #9)

Audit context

Part of v0.7.0 hardening epic — see .trellis/tasks/05-23-v0-7-0-hardening-release-epic/prd.md. Concurrent: #5 macOS fullscreen degrade (PR #29).

🤖 Generated with Claude Code