docs: design second round of settings validation consolidation

The independent verifier found 15 more checks still living only in from_env:
six enum domains, seven conditional-required pairs and two scalar ranges.
More severe than round one because client.py has five asserts that claim
config already validated the redis_url and telemetry paths, which is false on
the from_settings path.

Also records a normalisation gap the verifier missed: _load_pg_dsn strips the
SQLAlchemy +asyncpg suffix, so a hand-built DSN reaches asyncpg unstripped.

research-wiki/graph/edges.json

@@ -95,6 +95,11 @@
       "id": "design:settings-invariant-guards",
       "label": "GatewaySettings 跨字段不变量守卫的生效范围",
       "type": "design"
+    },
+    {
+      "id": "design:settings-invariants-round-2",
+      "label": "GatewaySettings 装配校验补齐(第二轮)",
+      "type": "design"
     }
   ],
   "links": [