Refuse a zero concurrency limit instead of reading it as the default

FLOW_MAX_WORKERS, FLOW_MAX_CASCADES and FLOW_MAX_RUNS are all pool sizes,
so 0 says neither "none" nor "unlimited" — it is a pool that cannot be
built. They are PositiveInt now, so a 0 fails at startup naming the
setting rather than being swallowed by `max_cascades or MAX_CASCADES`.
The consuming fallbacks take only None as "nobody said": explicit
`is None` in the executor, and no clamp on RunService.parallel.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01K1moruzue2kTJd3uVisgNk

backend/fluksio/core/config.py

@@ -9,6 +9,7 @@ from pydantic import (
     BeforeValidator,
     EmailStr,
     HttpUrl,
+    PositiveInt,
     computed_field,
     model_validator,
 )
@@ -97,15 +98,19 @@ class Settings(BaseSettings):
     # rather than a person, and it can refresh unattended.
     MCP_TOKEN_EXPIRE_MINUTES: int = 60
     MCP_REFRESH_EXPIRE_DAYS: int = 30
-    FLOW_MAX_WORKERS: int = 4
+    # The three below are all pool sizes, so 0 says neither "none" nor
+    # "unlimited" — it is a pool that cannot be built and an engine that would
+    # accept no work. Rejected here rather than quietly read as the default,
+    # because a limit somebody set and did not get is the worse surprise.
+    FLOW_MAX_WORKERS: PositiveInt = 4
     # How many cascades may be in flight at once. Sustained throughput is this
     # over the mean cascade time, so an installation whose nodes wait on the
     # network rather than on a CPU wants it higher than the core count.
-    FLOW_MAX_CASCADES: int = 4
+    FLOW_MAX_CASCADES: PositiveInt = 4
     # How many batch runs are driven at once. A different limit from the one
     # above: a run drives a whole graph, and its nodes are bounded by the worker
     # pool rather than by cascade slots. A sweep is what this governs.
-    FLOW_MAX_RUNS: int = 4
+    FLOW_MAX_RUNS: PositiveInt = 4
     # How long a python node may be silent before its worker is killed, unless
     # the node sets its own. 0, the default, disables it: a dead worker still
     # fails fast, and a slow one is left to finish. Set it where silence means