1:N adaptive control: aggregate N feedback streams into one encoder policy

[FelineStateMachine]

Part of #74. References @ 17980ad. Depends on the registry issue; interacts with fan-out.

The adaptive loop currently assumes exactly one authenticated feedback stream: FeedbackLease is single (crates/sigil-host/src/server.rs:1590-1598), and serve_media_feedback (server.rs:3160-3496) drives ShadowBitrateController and the motion-resolution policy from that one viewer's pressure.

• Accept one feedback stream per viewer; keep per-viewer CumulativeFeedbackIngress so per-client counters stay meaningful.
• Define the aggregation policy explicitly (this is the design core of the issue): the encoder is shared, so a decision must be a function of N pressure signals. Recommended default: encode follows the worst active viewer within a bounded floor; below the floor, the slow viewer is dropped to its own recovery/rejoin path (fan-out issue) instead of dragging the session for everyone. Make the policy a pure, unit-tested function of the N-viewer snapshot.
• Resolution tier decisions (MotionResolutionPolicy) and restore gating consider all viewers; restore requires clean windows from every active viewer.
• Per-viewer decision reporting: each viewer sees the committed global decision plus its own contribution, so Portal diagnostics stay truthful.
• Sequencing note: review issues [problem] Restore-to-native resolution switch can kill the in-process capture pipeline on a still screen #39 (restore can kill the pipeline) and [problem] CQP-configured hosts can never establish the media feedback stream #40 (CQP hosts get no feedback stream) live exactly in this code. Fix both before or with this work; do not port them into the N-viewer shape.

Tests: two viewers with asymmetric pressure (policy follows worst), floor-breach drops one viewer and the survivor recovers full rate, restore blocked while any viewer is dirty.