docs(qwp): remove stale design/ specs; fix budget-exhaustion javadoc residuals (Invariant B)

The design/ directory promised the removed reconnect-budget contract
(qwp-cursor-durability.md: 'On budget exhaustion: connection error
recorded -> next user-thread API call throws' -- now false under
Invariant B) and had drifted from the shipped code in several other
places. Remove the directory outright rather than patch it piecemeal.

Javadoc residuals fixed in the same sweep:
- CursorWebSocketSendLoop constructor: async-initial-connect terminals
  are auth/upgrade rejects only; plain connect failures retry
  indefinitely (no wall-clock budget give-up).
- CursorWebSocketSendLoop.recordFatal: drop the stale '(or it ran out
  of budget)' parenthetical -- no I/O-thread caller can exhaust a
  budget anymore.
- CloseDrainTest / PrReviewRedTestsE2e: drop references to the deleted
  design files; describe the contracts inline instead.

The connectWithRetry javadoc keeps its budget-exhaustion mention on
purpose: the blocking (sync) initial connect still honors
reconnect_max_duration_millis and throws.

Author: bluestreak01

core/src/main/java/io/questdb/client/cutlass/qwp/client/sf/cursor/CursorWebSocketSendLoop.java

@@ -273,9 +273,10 @@ public final class CursorWebSocketSendLoop implements QuietCloseable {
      * {@code client} may be {@code null} only if {@code reconnectFactory}
      * is non-null — this is the async-initial-connect path: the I/O thread
      * runs the same retry loop on its first iteration to obtain a live
-     * client, and a terminal failure (auth/upgrade reject or budget
-     * exhaustion) is delivered through the dispatcher rather than thrown
-     * to the constructor's caller.
+     * client, and a terminal failure (auth/upgrade reject) is delivered
+     * through the dispatcher rather than thrown to the constructor's
+     * caller; plain connect failures are retried indefinitely
+     * (Invariant B: no wall-clock budget give-up).
      */
     public CursorWebSocketSendLoop(WebSocketClient client, CursorSendEngine engine,
                                    long fsnAtZero, long parkNanos,
@@ -1366,7 +1367,7 @@ private void positionCursorInSegment(MmapSegment seg, long targetFsn) {
 
     /**
      * Mark the loop as fatally failed. Caller has decided no reconnect
-     * is possible (or it ran out of budget) — latch the error so
+     * is possible — latch the error so
      * {@link #checkError} can surface it to the producer thread, then
      * stop the loop. First-writer-wins: only the first failure latches.
      * The check-then-latch is unsynchronized and is safe ONLY because

core/src/test/java/io/questdb/client/test/cutlass/qwp/client/CloseDrainTest.java

@@ -38,8 +38,7 @@
 import java.util.concurrent.atomic.AtomicLong;
 
 /**
- * Regression tests for the close() drain semantics specified in
- * design/qwp-cursor-durability.md.
+ * Regression tests for the close() drain semantics.
  * <p>
  * Without {@code close_flush_timeout_millis}, close() returned as soon as
  * the cursor I/O loop's {@code running} flag flipped — meaning frames

core/src/test/java/io/questdb/client/test/cutlass/qwp/client/PrReviewRedTestsE2e.java

@@ -60,9 +60,9 @@ public class PrReviewRedTestsE2e {
      *   <li>{@code fail()} auth-terminal branch (lines 437-438)</li>
      *   <li>{@code fail()} budget-exhausted branch (lines 484-485)</li>
      * </ul>
-     * The locked spec ({@code design/qwp-cursor-error-api.md} § "Path 2:
-     * producer-side typed throw") requires {@code signal.terminalError = err}
-     * to be written BEFORE {@code errorInbox.offer(err)}.
+     * The error-API contract ("Path 2: producer-side typed throw") requires
+     * {@code signal.terminalError = err} to be written BEFORE
+     * {@code errorInbox.offer(err)}.
      * <p>
      * Concrete consequence the spec calls out: a user-supplied error handler
      * that synchronously calls {@code sender.flush()} from inside