Bound the work-queue durability claim to the appendfsync window

Redis runs with appendfsync everysec, so an unclean stop loses up to a
second of journaled entries. Name that where the docstrings promised a
crash costs nothing, and state the setting and its trade-off on the
configuration page.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CL9zvnnvcp1mvA8o7impxk

backend/fluksio/flow/pipeline.py

@@ -1522,7 +1522,8 @@ class Pipeline:
 
         With a work queue attached the event is journaled and the caller
         returns immediately — that is the path every external trigger takes, so
-        a crash mid-cascade loses nothing. Interactive callers (a manual run, a
+        a crash mid-cascade costs at most the last second of journaled work
+        rather than the whole wave. Interactive callers (a manual run, a
         draft preview) pass ``durable=False`` and get the old synchronous
         behaviour, because they are waiting for the result.