1:N limits, resource bounds, and multi-client test harness

[FelineStateMachine]

Part of #74. Final integration issue; depends on registry, fan-out, and adaptive.

Everything bounded for one client must be re-derived for N and proven under N.

• Resource audit: every queue, buffer, and per-session allocation currently sized for one viewer (frame channels, feedback ingress, MoQ cursors, audio delivery, telemetry) gets an N-scaled bound derived from max_viewers, with the derivation written down next to the constant.
• Abuse bounds: per-viewer rate limits on focus requests, keyframe requests (beyond the coalescing in the fan-out issue), and feedback report cadence; a misbehaving viewer is dropped individually with a reason, never by starving the group.
• Test harness: extend scripts/loopback-proof.sh and the CI harness to spawn N headless clients (target N=3 in CI, N=8 locally) exercising join/leave churn, focus transfer under churn, slow-consumer isolation, and revocation mid-session.
• Hardware UAT: add a multi-viewer leg to the UAT flow (gated on the runner fixes in review issues [problem] Hardware UAT runner hardcodes /dev/dri/renderD128 and vah264enc #44/[problem] Hardware UAT can never pass on hosts whose native panel is 1280x800 #45) with explicit pass criteria: sustained fps at N=3, bounded memory, focus handoff latency.
• Documentation: README capability/session model section updated from "one active client is enforced" to the viewer/focus model, with limits stated.