1:N media and audio fan-out over MoQ groups (relay-ready by construction)

[FelineStateMachine]

Part of #74. References @ 17980ad. Depends on the registry issue.

One encode, N subscribers. MoqGroupPublisher (crates/sigil-host/src/server.rs:2061-2169) and the versioned MoQ catalog (crates/sigil-host/src/moq_catalog.rs) are already group/broadcast shaped; this issue makes subscription per-viewer instead of per-the-one-session.

• Multi-viewer service is MoQ-transport-only (epic decision). Legacy v1/v2/v3 media streams remain valid only while exactly one viewer is connected; a second viewer without MoQ support gets an explicit rejection message naming the reason.
• Per-subscriber group cursors and slow-consumer policy: the bounded slow-consumer recovery proven in PR test(moq): prove bounded slow-consumer recovery #37 must hold per viewer, and one stalled viewer must not stall the others (drop that viewer to its recovery path instead).
• Audio fan-out gets the same treatment as video groups.
• Keyframe requests from N viewers coalesce through the existing ForcedIdrCoordinator (server.rs:1028-1183) with a rate bound, so N joining viewers produce one IDR, not N.
• Relay-ready by construction (epic call-out, non-negotiable in review): content authentication must not depend on which QUIC connection delivered an object. Concretely: the signed catalog plus per-object integrity must let a subscriber verify media that arrived from any peer, and subscriber authorization must be expressed against the enrollment identity rather than "the connection the host accepted". This costs little now and is the difference between the mesh issue being an optimization and being a redesign. The mesh issue reviews this design before merge.

Tests: 3-viewer loopback fan-out, slow-consumer isolation, join-storm IDR coalescing, legacy-transport second-viewer rejection.