fix(control): mitigate PV-only export over limits

[frahlg]

Summary

• Add a live Core guard for PV-attributed export above the effective site ceiling.
• Reuse feat(web): turn a driver's write path on from Settings #769's storage-aware solar attribution, so battery and V2X export do not cause solar curtailment.
• Use the same fuse-minus-margin and MaxExportW ceiling as the battery export guard.
• Merge the reactive cap with planner and manual caps by taking the tighter positive cap.
• Expose and log the reduction that Core cannot request safely.

Safety boundary

This is partial mitigation, not a claim of hard enforcement. The current curtail contract uses 0 W as release, and Ferroamp cannot safely accept an active zero through the current path. This PR therefore sends only positive caps above the known unsafe range.

PVExportResidualW reports the part of the overage that safe positive caps cannot cover, including unsupported PV. Command refusal remains visible through the existing actuation tracker. Full shutdown needs an explicit active/release contract plus per-driver zero/minimum capability and stays open in #885.

Tests

Tests cover:

• PV-only export above MaxExportW
• fuse ceiling and safety margin
• storage-attributed export exclusion
• composition with a stricter existing cap
• safe positive floor and residual math
• unsupported PV
• release after export returns below the ceiling

Verification:

• go test -race -count=1 ./internal/control
• go test -count=1 ./cmd/ftw
• pre-commit make verify
• pre-push make verify-all, including optimizer integration and Linux/Windows cross-builds

Stack and scope

This PR is stacked on the exact reviewed head of #769 to reuse solarSurplusW and avoid competing edits in dispatch.go. Retarget it to master after #769 lands.

No optimizer, config or driver code changes here.

Refs #885