1:N host registry: N concurrent sessions, focus token, lease rework

[FelineStateMachine]

Part of #74. References @ 17980ad. Depends on the protocol issue; strongly prefer landing #70 (server.rs split) first, since this rewrites what becomes session.rs.

Rework SessionRegistry from option-of-one to a map of N ActiveSessions.

• claim (crates/sigil-host/src/server.rs:1235-1268) stops bailing on an existing session; it enforces max_viewers from config instead. Session identity keys on the enrolled peer, preserving today's rule that a reconnecting peer replaces its own stale session rather than stacking.
• Replace the per-session input_claimed flag and single InputLease (server.rs:1573-1580) with a registry-owned focus token: at most one holder across all sessions, acquired only by input-capable sessions, released on disconnect, transferable via the protocol messages. Model it as a token set of capacity 1 (phase-2 hook from the epic).
• Focus lifecycle invariant: uinput neutralization runs on every path where focus leaves a holder (transfer, revoke, disconnect, crash). This subsumes review issue [suggestion] Make session-end input neutralization panic/cancellation-safe #55 (neutralization not panic/cancellation-safe); fix it here with a drop-guard owned by the focus token rather than patching the old shape first.
• AudioLease and FeedbackLease become per-session (N instances). Media claims move to the fan-out issue's model.
• Broadcast FocusState and roster updates to all connected viewers on every membership or focus change.
• Rejection behavior: an input-capable client connecting while focus is held still connects as a viewer; it gains a pending-focus path, not a refused session.

Tests: concurrent connect/disconnect races, focus-holder crash releasing focus with neutralization evidence, reconnect-replaces-own-session, max_viewers enforcement.