fix: register NATS/AMQP notify config keys read by parsers

GetNotifyNATS reads user_credentials, nkey_seed and tls_handshake_first
and GetNotifyAMQP reads immediate, but none of them were registered in
DefaultNATSKVS/DefaultAMQPKVS or the help schema, so CheckValidKeys
rejected any enable=on target carrying them. Worse, the legacy config
migration wrote exactly these keys - including the env var name
MINIO_NOTIFY_NATS_USER_CREDENTIALS used as a config key, because the
NATSUserCredentials constant doubled as both - so a migrated NATS config
failed validation on every load, and the FetchEnabledTargets fail-fast
then silently disabled all bucket notification targets.

- Register user_credentials/nkey_seed/tls_handshake_first (NATS) and
  immediate (AMQP) in the default KVS and help schema; split
  NATSUserCredentials into a real config key plus EnvNATSUserCredentials
  (all env var names byte-stable)
- Fix legacy migration: SetNotifyNATS writes the proper key;
  SetNotifyAMQP no longer writes cfg.Immediate under the internal key
  and now carries both immediate and internal
- Tolerate the legacy MINIO_NOTIFY_NATS_USER_CREDENTIALS key written by
  pre-fix migrations (NATS-scoped, load path only) with fallback read;
  env > user_credentials > legacy key
- Print key names only, never values, in the invalid-keys error of both
  CheckValidKeys forms; rejected values can carry credentials
- Add an AST-based audit test asserting parser reads, migration writes
  and help entries stay within the registered key set for all ten notify
  subsystems, with floor assertions so collector drift fails loudly
- Document (unchanged) FetchEnabledTargets fail-fast and pin it with a
  characterization test

Known same-class gap left in place and pinned by the audit's allowlist:
SetNotifyPostgres/SetNotifyMySQL write five unregistered DSN-era keys;
tracked for a follow-up issue.

Closes #39

Co-authored-by: ChatGPT <noreply@openai.com>
Co-authored-by: Claude <noreply@anthropic.com>

internal/config/notify/help.go

@@ -111,6 +111,12 @@ var (
 			Optional:    true,
 			Type:        "on|off",
 		},
+		config.HelpKV{
+			Key:         target.AmqpImmediate,
+			Description: "return messages that cannot be delivered to a consumer straight away when set to 'on', default is 'off'",
+			Optional:    true,
+			Type:        "on|off",
+		},
 		config.HelpKV{
 			Key:         target.AmqpDurable,
 			Description: "persist queue across broker restarts when set to 'on', default is 'off'",
@@ -459,6 +465,13 @@ var (
 			Type:        "string",
 			Sensitive:   true,
 		},
+		config.HelpKV{
+			Key:         target.NATSUserCredentials,
+			Description: "path to NATS user credentials (.creds) file for JWT auth",
+			Optional:    true,
+			Type:        "string",
+			Sensitive:   true,
+		},
 		config.HelpKV{
 			Key:         target.NATSPassword,
 			Description: "NATS password",
@@ -475,6 +488,13 @@ var (
 			Sensitive:   true,
 			Secret:      true,
 		},
+		config.HelpKV{
+			Key:         target.NATSNKeySeed,
+			Description: "path to NATS NKey seed file",
+			Optional:    true,
+			Type:        "string",
+			Sensitive:   true,
+		},
 		config.HelpKV{
 			Key:         target.NATSTLS,
 			Description: "set to 'on' to enable TLS",
@@ -487,6 +507,12 @@ var (
 			Optional:    true,
 			Type:        "on|off",
 		},
+		config.HelpKV{
+			Key:         target.NATSTLSHandshakeFirst,
+			Description: "set to 'on' to perform TLS handshake before waiting for server INFO",
+			Optional:    true,
+			Type:        "on|off",
+		},
 		config.HelpKV{
 			Key:         target.NATSPingInterval,
 			Description: "client ping commands interval in s,m,h,d. Disabled by default",