feat(server): enforce per-IP connection cap

[jonathandeamer]

Summary

• add an RAII per-IP connection limiter keyed by the accepted peer address
• drop over-cap connections silently before worker dispatch, preserving the no-leakage contract
• add --max-conns-per-ip, derived by default as max(1, workers / 8) and validated through the neutralizing maximum workers + 1
• cover limiter accounting, worker integration, CLI validation/help, permit release, and rendezvous neutralization
• update the approved design, security model, and production-readiness roadmap

Context

PR #51 added the production nftables layer for issue #29: per-source concurrent connection limits plus new-connection rate limiting. Its commit history deliberately left the in-app concurrent cap open so the binary would also be safe by default on OpenBSD or deployments without a host firewall.

This PR completes that remaining application-layer work. The application only accounts for concurrent resources; connection-rate limiting remains owned by the firewall. Reverse-proxy deployments can neutralize the in-app cap with workers + 1, which includes the extra accepted stream that can be parked on the zero-capacity rendezvous channel.

Validation

• make check
• 115 tests pass
• Clippy passes with -D warnings

Human merge requested because this changes the worker-exhaustion threat model.

Closes #29