Replay large leftover WAL under elevated memory limit before opening cold store.

DuckDB replays an unchecked WAL synchronously inside the open call, under
whatever memory limit the connection was configured with. Replaying an
insert-style WAL re-inserts every row through the primary key index, so
it needs far more memory than the WAL size: a 16MB leftover WAL measured
~330MB of replay memory against a multi-million-row table. With the
default 256MB db_max_memory_mb this exhausts memory during open and
raises FatalException, which crosses the FFI boundary as terminate ->
SIGABRT, so the existing Err-only recovery ladder never runs and
systemd's Restart=always crash-loops the router (issue #220: 7 restarts
in ~3 minutes; verified on a copy of the production database).

Before opening with the configured limit, drain any WAL above 1MB with a
one-shot connection whose limit is max(configured, 1024MB, 32x WAL size)
and run CHECKPOINT. If that fails, fall through to the existing recovery
ladder with a warning rather than blocking startup.

Fixes #220

Author: Cloud370