NA-0168: explicit 429 overload + queue depth observability (no channel leak)

[Tebbens4832]

Goals: G4, G5

Adjacency scan commands:

• rg -n "MAX_QUEUE_DEPTH|queue_depth|VecDeque|push(|try_push|overload|full" src -S
• rg -n "channel=|/v1/push|/v1/pull|Authorization|Bearer|log" src tests -S

Root updates:

• Queue-full now returns HTTP 429 with deterministic body .
• Added explicit safe overload observability log: .
• Preserved capability hygiene: no raw channel/token logging.

Tests:

• Updated queue-full expectations to .
• Added overload log safety test asserting structured overload event, no raw channel, and no long token-like hex runs.

No-regression:

• Existing relay smoke/integration/unit tests pass.
• No auth/token semantics changes.