feat(browser): bound host admission

[Jinwoo-H]

	Files	Added	Deleted	Net
Test	3	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​243	0	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​243
Prod	3	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​89	$\color{#cf222e}{\Huge{\mathbf{−}}}$​18	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​71

Summary

• cap one browser-host identity per authenticated connection and four per paired device, with exact release restoring capacity
• meter permanent browser-host subscriptions under a dedicated 25% long-poll sub-cap so terminal/orchestration waits retain capacity
• replace per-page generation tombstones with one global monotonic generation
• make placement retirement token-safe so delayed cleanup cannot delete a newer client generation or server placement

This is the fourth inert layer for STA-4150, stacked on #14484. Production RPC registration and capability advertisement remain disabled.

Causal evidence

On the parent branch, one unchanged oracle failed three ways: a second identity on one connection was admitted, a fifth identity for one paired device was admitted, and closed page placement had no retirement API. Those cases are now bounded and exact.

Fresh review then found two additional lifecycle failures before publication: delayed cleanup could erase a replacement placement, and four devices could occupy all 16 shared long-poll slots. Retirement now requires the exact placement object, and a real injected WebSocket test proves host saturation still admits an ordinary wait and socket close aborts/releases both classes.

Validation

• 11 focused files / 67 tests
• 15 unique tunnel/lease/runtime files / 92 tests
• full runtime RPC suite / 90 tests
• cross-version terminal wire / 5 tests
• pnpm typecheck
• native and type-aware code-quality audits
• reliability-gate manifest and max-lines ratchet
• fresh correctness rereview: no remaining findings

Deliberately deferred before activation

• pending tunnel-open/rate admission and aggregate route/host/process byte ledgers
• wiring token-safe placement retirement into the future production page lifecycle
• drain-aware stream fairness and SOCKS local-process trust decision
• SSH/WSL/Linux/physical-Windows and old/new-peer journeys
• Electron partition proxy/no-fallback proof and UI activation