refactor(config): decompose ServerConfig into focused single-concern files

ServerConfig and its supporting types (LogFormat, PortsConfig, path
helpers, and the new ServerSection wrapper) were all defined inline in
mod.rs, which had grown past 400 lines of mixed concerns. Each type now
lives in its own file: config.rs, log_format.rs, paths.rs, ports.rs,
and section.rs. mod.rs is reduced to pub-mod declarations and re-exports.

All call sites that accessed flat config fields (config.host,
config.data_dir, config.ports.*, etc.) are updated to the new
config.server.* path introduced by ServerSection. Bootstrap modules,
main.rs, env.rs, and auth security tests all updated accordingly.

Author: farhan-syah

nodedb/src/bootstrap/background_loops.rs

@@ -27,13 +27,19 @@ pub struct EventPlaneComponents {
 /// Includes: Event Plane consumers, event trigger processor, webhook manager wiring,
 /// collection GC, L2 cleanup, tenant rate/audit/memory timers, checkpoint manager,
 /// usage metering flush, and cold tier task.
+///
+/// Returns the [`EventPlane`] handle. The caller MUST hold this for the
+/// server's lifetime — dropping it aborts every consumer task and turns
+/// the per-core event ring buffers into one-way drains, which silently
+/// loses every WriteEvent emitted by the Data Plane until process exit.
+#[must_use = "EventPlane must be held for the server's lifetime; dropping it stops all event consumers"]
 pub fn spawn_background_loops(
     shared: &Arc<SharedState>,
     components: EventPlaneComponents,
     config: &ServerConfig,
     num_cores: usize,
     shutdown_rx: tokio::sync::watch::Receiver<bool>,
-) {
+) -> crate::event::EventPlane {
     let EventPlaneComponents {
         wal,
         event_consumers,
@@ -47,7 +53,10 @@ pub fn spawn_background_loops(
     shared.webhook_manager.set_state(Arc::clone(shared));
 
     // Event Plane: one consumer Tokio task per Data Plane core.
-    let _event_plane = crate::event::EventPlane::spawn(
+    // Returned to the caller — must outlive the server, otherwise its
+    // Drop impl aborts every consumer and the Data Plane producers
+    // start dropping every WriteEvent they emit.
+    let event_plane = crate::event::EventPlane::spawn(
         event_consumers,
         Arc::clone(&wal),
         watermark_store,
@@ -144,7 +153,7 @@ pub fn spawn_background_loops(
     if let Some(ref cold_settings) = config.cold_storage {
         let shared_cold = Arc::clone(shared);
         let cold_settings_clone = cold_settings.clone();
-        let data_dir_clone = config.data_dir.clone();
+        let data_dir_clone = config.server.data_dir.clone();
         let shutdown_rx_cold = shutdown_rx.clone();
         crate::control::cold_tier::spawn_cold_tier_task(
             shared_cold,
@@ -154,6 +163,8 @@ pub fn spawn_background_loops(
         );
         info!("cold tier task spawned");
     }
+
+    event_plane
 }
 
 /// Spawn the response poller loop (routes Data Plane responses to waiting sessions).

nodedb/src/bootstrap/credentials.rs

@@ -45,7 +45,10 @@ pub fn replay_surrogate_wal(shared: &Arc<SharedState>, wal_records: &Arc<[WalRec
 /// Bootstrap the superuser credential from config / data dir, or warn about trust mode.
 pub fn bootstrap_superuser(shared: &Arc<SharedState>, config: &ServerConfig) -> anyhow::Result<()> {
     let auth_mode = config.auth.mode.clone();
-    match config.auth.resolve_superuser_password(&config.data_dir) {
+    match config
+        .auth
+        .resolve_superuser_password(&config.server.data_dir)
+    {
         Ok(Some(password)) => {
             shared
                 .credentials
@@ -79,11 +82,11 @@ pub fn print_startup_banner(config: &ServerConfig, cluster_mode_str: &str) {
     eprintln!(
         "{}",
         crate::version::format_banner(
-            config.ports.pgwire,
-            config.ports.http,
-            config.ports.native,
+            config.server.ports.pgwire,
+            config.server.ports.http,
+            config.server.ports.native,
             cluster_mode_str,
-            &config.data_dir.display().to_string(),
+            &config.server.data_dir.display().to_string(),
             &format!("{:?}", config.auth.mode),
         )
     );

nodedb/src/bootstrap/data_plane.rs

@@ -75,7 +75,7 @@ pub fn spawn_data_plane_cores(
         quarantine_registry,
         system_metrics,
     } = resources;
-    let num_cores = config.data_plane_cores;
+    let num_cores = config.server.data_plane_cores;
     let compaction_cfg = CoreCompactionConfig {
         interval: config.checkpoint.compaction_interval(),
         tombstone_threshold: config.checkpoint.compaction_tombstone_threshold,
@@ -92,7 +92,7 @@ pub fn spawn_data_plane_cores(
             core_id,
             data_side.request_rx,
             data_side.response_tx,
-            &config.data_dir,
+            &config.server.data_dir,
             Arc::clone(&wal_records),
             replay_tombstones.clone(),
             num_cores,

nodedb/src/bootstrap/listeners.rs

@@ -55,7 +55,7 @@ pub async fn spawn_protocol_listeners(
     let tls_for = |enabled: bool| -> Option<tokio_rustls::TlsAcceptor> {
         if enabled { base_acceptor.clone() } else { None }
     };
-    let tls_flags = config.tls.as_ref();
+    let tls_flags = config.server.tls.as_ref();
     let pgwire_tls_enabled = tls_flags.is_some_and(|t| t.pgwire);
     let http_tls_enabled = tls_flags.is_some_and(|t| t.http);
     let resp_tls_enabled = tls_flags.is_some_and(|t| t.resp);
@@ -89,7 +89,7 @@ pub async fn spawn_protocol_listeners(
     let http_auth_mode = config.auth.mode.clone();
     let http_listen = config.http_addr();
     let http_tls = if http_tls_enabled {
-        config.tls.clone()
+        config.server.tls.clone()
     } else {
         None
     };

nodedb/src/bootstrap/state_wiring.rs

@@ -109,7 +109,10 @@ pub fn wire_state(
             .as_ref()
             .map(|s| s.to_snapshot_storage_config())
             .unwrap_or_else(crate::config::server::SnapshotStorageSettings::default_storage_config);
-        match crate::storage::snapshot_writer::build_snapshot_store(&snap_cfg, &config.data_dir) {
+        match crate::storage::snapshot_writer::build_snapshot_store(
+            &snap_cfg,
+            &config.server.data_dir,
+        ) {
             Ok(store) => {
                 if let Some(state) = Arc::get_mut(shared) {
                     state.snapshot_storage = store;
@@ -132,8 +135,10 @@ pub fn wire_state(
             .unwrap_or_else(
                 crate::config::server::QuarantineStorageSettings::default_storage_config,
             );
-        match crate::storage::quarantine::registry::build_quarantine_store(&q_cfg, &config.data_dir)
-        {
+        match crate::storage::quarantine::registry::build_quarantine_store(
+            &q_cfg,
+            &config.server.data_dir,
+        ) {
             Ok(store) => {
                 if let Some(state) = Arc::get_mut(shared) {
                     state.quarantine_storage = store;
@@ -209,7 +214,7 @@ pub fn wire_state(
             crate::control::trace_export::TraceExporter::disabled()
         };
         state.debug_endpoints_enabled = config.observability.debug_endpoints_enabled;
-        state.data_dir = config.data_dir.clone();
+        state.data_dir = config.server.data_dir.clone();
         state.scheduler_config = config.scheduler.clone();
     }
 

nodedb/src/bootstrap/tracing_init.rs

@@ -14,7 +14,7 @@ use crate::ServerConfig;
 /// `tracing::info!` / `tracing::warn!` calls are expected to emit.
 pub fn init_tracing(config: &ServerConfig) {
     let filter = EnvFilter::try_from_default_env().unwrap_or_else(|_| EnvFilter::new("warn"));
-    if config.log_format == crate::config::LogFormat::Json {
+    if config.server.log_format == crate::config::LogFormat::Json {
         tracing_subscriber::registry()
             .with(
                 tracing_subscriber::fmt::layer()