feat: add an opt-in NATS JetStream publish path for the notify and audit targets (#4634)

feat(targets): add an opt-in NATS JetStream publish path for the notify and audit targets

The NATS notify and audit targets publish through NATS Core, which returns
before the server has durably accepted the message. A broker restart or a
connection drop between the publish and the flush loses the event, even though
the send queue has already cleared it, and no acknowledgement gates that clear.

An opt-in JetStream publish path clears a queued event only after the server
returns a durable PublishAck, so delivery is at-least-once across a broker
restart or a reconnect. It applies to both the notify and audit NATS targets, is
off by default, and is byte-identical to the NATS Core path when disabled.

The path includes durable store-and-forward, a stable dedup id sent as the
Nats-Msg-Id header so a replayed event is collapsed by the stream duplicate
window, pre-flight stream validation, and a bounded failed-events store for
terminally-failed and retry-exhausted events. Three configuration keys per
target select it: JETSTREAM_ENABLE, JETSTREAM_STREAM_NAME, and
JETSTREAM_ACK_TIMEOUT_SECS, under the RUSTFS_NOTIFY_NATS_ and RUSTFS_AUDIT_NATS_
prefixes.

The on-disk batch filename separator changes from colon to underscore so
batch names are valid on Windows filesystems, with transparent read-back
of files written under the previous separator. The migration affects the
shared queue store for every target type and lands with this feature
because the store gains its first Windows-exercised paths here.

Co-authored-by: houseme <housemecn@gmail.com>

crates/targets/src/check.rs

@@ -100,11 +100,27 @@ pub async fn check_nats_server_available(args: &crate::target::nats::NATSArgs) -
             .flush()
             .await
             .map_err(|e| crate::TargetError::Network(format!("NATS connection check failed: {e}")))?;
+        // Validate the configured stream on the live connection before the drain closes it, so a
+        // missing or non-writable stream is rejected here rather than at first publish. The lookup is
+        // read-only and never creates a stream. The drain runs regardless of the validation outcome so
+        // the check connection is closed gracefully, and the validation error then propagates.
+        let validation = if args.jetstream_enable.unwrap_or(false) {
+            let mut context = async_nats::jetstream::new(client.clone());
+            // Match every other context construction site: the ack timeout is the per-operation await
+            // bound, so the validation get_stream lookup uses it rather than the library default.
+            context.set_timeout(std::time::Duration::from_secs(
+                args.jetstream_ack_timeout_secs
+                    .unwrap_or(rustfs_config::NATS_JETSTREAM_ACK_TIMEOUT_DEFAULT_SECS),
+            ));
+            crate::target::nats::validate_jetstream_stream(&context, args, "nats-check", None).await
+        } else {
+            Ok(())
+        };
         client
             .drain()
             .await
             .map_err(|e| crate::TargetError::Network(format!("Failed to close NATS check connection: {e}")))?;
-        Ok(())
+        validation
     })
     .await
     .unwrap_or_else(|_| Err(crate::TargetError::Timeout("NATS connection timed out".to_string())))