docs: design settings invariant guards on every construction path

Guards for the three cross-field invariants (source timeout vs lease TTL,
stall window vs max TTFT, probe TTL vs slowest timeout) only ran inside
from_env, so the from_settings path could build a GatewaySettings that
violates the class's own documented invariants. Design moves all of them
plus a non-empty sources check into __post_init__ as _validate_* methods,
matching the existing frozen dataclasses in types.py.

Covers two defects left by PR#1: probe_ttl_s was never moved, and an empty
sources tuple leaked a bare 'max() arg is an empty sequence'.

research-wiki/graph/edges.json

@@ -90,6 +90,11 @@
       "id": "finding:m4-acceptance",
       "label": "M4 迁移验收(GovDoc+CHS)",
       "type": "finding"
+    },
+    {
+      "id": "design:settings-invariant-guards",
+      "label": "GatewaySettings 跨字段不变量守卫的生效范围",
+      "type": "design"
     }
   ],
   "links": [