Fix five bulletin and input validation bugs

[blisspixel]

Broken bulletin configuration could hide retained public posts, unsupported API reads returned HTML with status 200, and malformed reporting addresses could open posting. The directory CLI also loaded whole files before applying its input limit, and the local reader accepted zero ports written as :00.

This patch fixes those five cases while preserving the existing service operations:

• Keep public info, history, and HTML inspection readable when posting configuration fails; mutations remain closed.
• Reject unsupported board methods with problem JSON and a route-specific Allow header. Individual API post routes remain removal-only.
• Validate conservative ASCII reporting-mailbox syntax, including local-part and domain-label bounds. Syntax does not verify ownership or delivery.
• Stop directory input reading at 65,537 bytes, then enforce the existing 65,536-byte catalog limit before output.
• Reject every zero-port spelling before the reader performs network work.

Each bug was reproduced before its fix. Regression tests cover retained SQLite state across configuration changes, closed writes, supported-method reporting, malformed mailboxes, read limits, I/O failures, exact-limit catalogs, and IPv4/IPv6 port boundaries. Service instructions, validation notes, and the roadmap describe the resulting behavior. These changes do not implement the planned change feed or establish public deployment.

Validation completed locally:

• Required formatting, workspace Clippy, repository/schema checks, and strict mypy 2.3.1.
• Full Rust workspace tests through cargo llvm-cov: 91.56% line coverage, above the 80% gate.
• Wasm-target Clippy, static directory build, pinned Worker build, and all six tests against the actual local Cloudflare runtime.
• Full Python test and example sequence from CI, including both hosts: 91.02% line coverage, above the 80% gate.

All 26 branch and pull-request CI checks passed before merge. Pull-request CI covers the Cloudflare runtime, installers, Rust platforms, Python 3.11/3.14 platform matrix, documentation, and coverage gates.

After merge, all 13 checks passed on exact main commit 9efd0637004aeb2c9eb20506d9c64441c36845cd. Merged main CI. The short-lived branch was deleted.