fix(db2): add numeric config range validation (fix P2-3/P3-8)

- Add range checks in load_config() for all numeric config values:
  * listen_port: 1-65535
  * workers: >= 1
  * cleanup_interval: >= 1 (prevents busy loop DoS when misconfigured to 0/negative)
  * retention_days: >= 0
  * max_records: >= 1
- Fix unused lambda capture 'this' in RpcServer error handler
  (-Wunused-lambda-capture with -Wall -Werror)
- Update security audit doc: mark P2-3/P3-8 fixed, mark production ready

Verified: g++ -std=c++20 -O3 -Wall -Werror compiles with zero warnings.

db2/src/db2.cpp

@@ -204,6 +204,28 @@ static Config load_config(int argc, char* argv[]) {
         else if ((arg == "--workers" || arg == "-w") && i + 1 < argc) cfg.workers = std::stoi(argv[++i]);
     }
 
+    // 6. 数值配置范围校验（防误配置导致异常行为）
+    if (cfg.listen_port < 1 || cfg.listen_port > 65535) {
+        std::fprintf(stderr, "[db2] invalid listen_port: %d (must be 1-65535)\n", cfg.listen_port);
+        std::exit(1);
+    }
+    if (cfg.workers < 1) {
+        std::fprintf(stderr, "[db2] invalid workers: %d (must be >= 1)\n", cfg.workers);
+        std::exit(1);
+    }
+    if (cfg.cleanup_interval < 1) {
+        std::fprintf(stderr, "[db2] invalid cleanup_interval: %d (must be >= 1 second)\n", cfg.cleanup_interval);
+        std::exit(1);
+    }
+    if (cfg.retention_days < 0) {
+        std::fprintf(stderr, "[db2] invalid retention_days: %d (must be >= 0)\n", cfg.retention_days);
+        std::exit(1);
+    }
+    if (cfg.max_records < 1) {
+        std::fprintf(stderr, "[db2] invalid max_records: %d (must be >= 1)\n", cfg.max_records);
+        std::exit(1);
+    }
+
     return cfg;
 }
 
@@ -301,7 +323,7 @@ public:
         srv_cfg.workers = _cfg.workers;
 
         RpcServer rpc(_cfg.listen_host, _cfg.listen_port, srv_cfg,
-            [this](const std::string& route, const std::exception& e) {
+            [](const std::string& route, const std::exception& e) {
                 std::fprintf(stderr, "[db2] handler error route=%s: %s\n",
                              route.c_str(), e.what());
             });