fix(api): reject typed nil transport contexts

[ryan-wong-coder]

Linked Issue

Fixes #15

Summary

• reject typed nil root contexts in both HTTP and gRPC constructors
• reject typed nil shutdown contexts before either adapter calls Deadline
• preserve the existing ErrNilRootContext and ErrNilShutdownContext contracts
• add panic-on-use context doubles proving validation does not invoke a typed nil receiver

Required Format

• Branch name uses an approved prefix: feat/, fix/, docs/, test/, refactor/, perf/, security/, chore/, ci/, build/, release/, or revert/.
• PR title uses Conventional Commit style, for example fix(consensus): reject equivocated proposer slots.
• Commit messages use Conventional Commits.

Scope And Project Status

• This PR solves one issue or one clearly scoped maintenance task.
• This PR excludes unrelated formatting, experiments, generated files, local data, credentials, logs, captures, and build artifacts.
• User-facing material distinguishes implemented behavior, target design, and roadmap work.
• Any performance claim identifies its source, hardware, configuration, measurement method, and whether it is a FinalWeave result.

No performance claim or user-facing capability is introduced.

Protocol, Safety, And Compatibility

• This PR does not change quorum, Byzantine fault, proposer-slot, stable-prefix, or epoch-transition rules.
• BatchAC still proves recoverable data availability only; it is not treated as transaction validity, ordering, or execution finality.
• Canonical ordering and speculative parallel execution remain deterministic and equivalent to canonical serial Apply.
• External finality remains bound to an authenticated Header, exact FinalityCertificate, locally trusted validator/config chain, and query-specific proofs.
• This PR does not change canonical encoding, domain separation, signatures, IDs, state commitments, or wire schemas.
• WAL, atomic publication, snapshots, pruning, synchronization, replay, and recovery preserve their durable safety boundaries.
• This PR does not change networking, admission, cross-ledger proof validation, or resource-accounting boundaries.
• No production path introduces unbounded scan, sort, load, verification, retry, amplification, or recomputation behavior.

This changes only invalid local API input handling: a typed nil context now returns the same explicit error as a literal nil context instead of reaching a possible nil-receiver panic. Successful calls are unchanged. There are no releases or runtime users, so no compatibility layer is needed.

Validation

• git diff --check
• python3 scripts/check_docs.py
• go mod verify and a clean go mod tidy diff
• go vet ./...
• go test -count=1 -mod=readonly ./...
• go test -race -count=1 -mod=readonly ./...
• python3 scripts/check_go_architecture.py
• Relevant unit, race, property, fuzz, vector, model, Byzantine, partition, crash-recovery, snapshot, chaos, and performance checks
• Negative tests cover malformed, conflicting, stale, replayed, oversized, and partially durable inputs where applicable

Additional focused validation:

• go test -count=50 ./pkg/api/httpserver ./pkg/api/grpcserver
• go test -race -count=50 ./pkg/api/httpserver ./pkg/api/grpcserver
• Linux amd64 and arm64 static builds with -trimpath

Protocol, storage, Byzantine, partition, snapshot, and chaos suites are not applicable to this constructor/shutdown input-validation fix.

Risk And Rollback

Risk is minimal and limited to callers that supplied a typed nil context and relied on undefined panic-prone behavior. Literal nil and all valid contexts retain their existing behavior.

Rollback by reverting this commit; no schema, dependency, data, listener, or migration is involved.