[Security] HIGH-10 Replace panic-prone unwrap calls with controlled errors

[kenken64]

Summary

Missing public IPs or poisoned locks can crash the process rather than returning a handled error.

Finding

• ID: HIGH-10
• Severity: High
• Source: docs/EVAL_SECURITY_FLAW.md

Affected Files

• crates/clawmacdo-cli/src/commands/deploy.rs
• crates/clawmacdo-cli/src/commands/serve.rs

Goal

Eliminate panic-based failure in deploy and web-server paths for these cases.

Likely Changes

• Replace unwrap on cloud IP access with explicit error propagation.
• Replace database lock unwrap with poisoned-lock handling and controlled failure.
• Preserve clear diagnostics without crashing the process.

Acceptance Criteria

• The affected unwrap calls in deploy and serve paths are removed.
• Missing public IPs produce actionable errors instead of panics.
• Database lock failures do not permanently crash subsequent requests.
• Existing success paths still behave normally.
• Error behavior is covered by targeted tests where practical.