[Mathieu2301]

Summary

• add finite process-wide limits for active connections, connection attempts, tracked source addresses, active homes, and aggregate queued bytes
• key admission by the immediate TCP peer and deliberately ignore caller-controlled forwarded headers
• reserve and release the shared outbound queue budget across every lifecycle path, with safe retryable HTTP and protocol failures
• document the bounded deployment profile and expose validated environment configuration for staging overrides

Validation

• go test ./...
• go test -race ./...
• go vet ./...
• CI-equivalent race and coverage suite
• scripts/check-control-plane-integration.sh
• scripts/check-miakapi-integration.sh
• scripts/check-platform-integration.sh
• production Docker image build
• gofmt and git diff --check

Cloud impact

None. This PR only changes the relay implementation and tests; it does not deploy or modify cloud resources.