Summary

Null values in frontmatter were silently skipping all validation checks. Now they correctly trigger:

• NullNotAllowed when nullable = false (regardless of required)
• Disallowed when the field appears at a path not in allowed

Both can fire simultaneously on the same field.

WrongType is not checked for null values (null is accepted by any type).

Closes TODO-0117.

Test plan

• 4 new tests: null on non-nullable, null on nullable, null on disallowed path, null on disallowed + non-nullable
• 268 tests pass, clippy clean, fmt clean
• Verified on vault: 5 NullNotAllowed violations correctly detected