chore: code review cleanup — fixes, deps, docs

Fixed:
- CLI help typo: "metatdata" -> "metadata"
- Filter buffer OOM: check size before loading into memory

Changed:
- #[inline] on HTML escape helpers for hot path performance
- Replaced once_cell and lazy_static with std::sync::LazyLock
- Removed unused once_cell and lazy_static crate dependencies

Refactored:
- Added module-level doc to services/ module

Documentation:
- README.md: zstd is native not external, "none" -> "raw"
- DESIGN.md: current schema and meta plugins section
- CHANGELOG.md: Unreleased section populated

Cargo.lock

@@ -1727,7 +1727,6 @@ dependencies = [
  "inventory",
  "is-terminal",
  "jsonwebtoken",
- "lazy_static",
  "libc",
  "local-ip-address",
  "log",
@@ -1735,7 +1734,6 @@ dependencies = [
  "magic",
  "md5",
  "nix",
- "once_cell",
  "os_pipe",
  "pest",
  "pest_derive",