[vnvo]

Stacked on #14. Rebased onto main with #11: the new config fields sit alongside max_message_size.

Four additive features for consumers that manage their own durability and failover, and a documentation fix. No existing signature changes; ReplicationConfig is #[non_exhaustive], so the new fields are not breaking.

• ack_lsn / with_ack_lsn: the LSN reported as flushed and applied until the first update_applied_lsn (default start_lsn, as before). A consumer that resumes reading ahead of its durable position keeps the slot at that position.
• ReplicationClient::wait_started: returns once the server accepted START_REPLICATION, when the slot is held by the session, or the worker's error if it ended first.
• application_name / with_application_name: the startup application_name (default pgwire-replication), so a consumer can find its own walsender in pg_stat_activity.
• Gated sessions: connect_gated authenticates and waits. simple_query, identify_system and timeline_history run on that session until start sends START_REPLICATION, so what is read before the start describes the server the stream opens on. A server error leaves the session usable; dropping the client before start sends Terminate. Query rows are bounded by max_message_size (feat: configurable maximum replication message size #11) like the replication stream: a larger row is refused with MessageTooLarge and ends the session.
• Docs: status_interval documented a 1 second default; it is 10 seconds. The README describes change-driven feedback on an idle stream.

Tests

• Unit: the gate protocol (answers, a server error, a closed gate, a broken session, a malformed DataRow) and the startup application_name.

• Integration (PostgreSQL 16):

  • postgres_ack_lsn_holds_the_slot, with a control showing the slot advances without ack_lsn;
  • postgres_wait_started_holds_the_slot, including a missing slot;
  • postgres_gated_session.

  Each was checked to fail against a mutation of the feature.

• cargo semver-checks against 0.4.1: 202 checks pass. It first found that ReplicationConfig (the observer from Observe how long acknowledged positions wait before the server hears of them #14) and ReplicationClient (a oneshot start signal) had lost UnwindSafe/RefUnwindSafe; both are fixed, and tests/auto_traits.rs guards the public types' auto traits.

• fmt, clippy (default and all features, also on Rust 1.99), tests, doc tests, docs with -D warnings, the loom model, and cargo audit on a fresh resolve.