Settings Allows Partially-Configured Credentials

[henry0816191]

Problem

The Settings class in config.py defaults slack_signing_secret and slack_bot_token to empty strings (""). This means a Settings object can be fully constructed in a valid state with no Slack credentials. create_app() will build a Slack App with empty tokens, which only fails at the first API call deep inside poll_once's notification path, surfacing as a SlackApiError that looks identical to a transient Slack outage. While DATABASE_URL has an explicit empty-check with sys.exit(1) in __main__.py:92-94, no equivalent guard exists for Slack credentials.

Acceptance Criteria

• Add a pydantic @model_validator (or @field_validator) on Settings that raises ValidationError when slack_signing_secret or slack_bot_token are empty strings, with a clear error message
• Alternatively, if Slack-less operation should be supported, add a slack_enabled: bool computed field and guard all Slack API calls behind it
• Add tests: constructing Settings with empty Slack tokens either raises or correctly sets slack_enabled=False
• Document required vs. optional credentials in .env.example with comments

Bugfix bundle — dead config / stale DB module comment (paperscout_bugfix_bundle_27f91caa.plan.md §5)

• Remove unused enable_bulk_openstd from Settings in config.py (grep confirms it is unreferenced; extra="ignore" still allows stray env vars).
• Rewrite the stale module-level comment on pool in db.py: the pool is passed explicitly through constructors; paperscout.db.pool is not assigned by __main__ (prefer comment-only fix over introducing a global unless you standardize on one pattern).

Implementation Notes

This finding overlaps with item 1 (Opaque failure path). If item 1 is implemented first, this may be partially addressed. The key decision is whether paperscout should support running without Slack (e.g., for development/testing). If yes, use a slack_enabled flag; if no, use a validator that rejects empty tokens at startup. The pydantic-settings @model_validator(mode='after') hook is the right place.

References

• Eval finding: Test 7 (Misuse Resistance) + Test 9 (Defaults Quality), cluster Correctness of Use
• Related files: src/paperscout/config.py, src/paperscout/__main__.py, .env.example