add broker QUIC flow-control flags and stats, apply client stream limit

[fabracht]

Adds the broker QUIC flags that the experiment scripts merged in #176 pass (04_transport_limits_v5.sh, 04b_stream_limit_sweep.sh, 03c_offload_ablation.sh, 03d_offload_lowload.sh). None of them existed on main, so those scripts failed against a broker built from the repo.

Changes

• Broker QuicConfig / QuicAcceptorConfig: max_concurrent_streams, stream_receive_window, disable_segmentation_offload, with CLI flags --quic-max-streams, --quic-stream-window, --quic-disable-offload.
• Client fix: QuicConfig::with_max_concurrent_streams (and MqttClient::set_quic_max_streams, bridge quic_max_streams) was stored but never applied to the QUIC transport.
• Broker QUIC stats: with MQTT5_QUIC_STATS_DIR set, the broker writes one CSV per QUIC connection (row every 100 ms, final row at close). 04_transport_limits_v5.sh sets COLLECT_QUIC_STATS=1 and collects these files; the sampler was only on the unmerged broker-quic-stats branch. The columns match what analysis/transport_limits.py reads, including streams_blocked_uni (always 0 with quinn 0.11 clients).
• QUIC integration tests now use in-memory storage. They shared ./mqtt_storage in parallel, which since 0.42.0 means one sessions.log; that caused the intermittent ServerUnavailable and address-in-use failures in broker_quic_integration (3 of 8 local runs on main, 0 of 10 after). The underlying problem is broker should lock its storage directory so two brokers cannot share sessions.log #179.
• Adds the TLA+ spec of the QoS 1 backlog drain (specs/tla/qos1-backlog/); the design it models is already on main.
• Eight tests in quic_multistream_integration.rs returned early and passed whenever a client failed to connect; they now fail.
• Removes expect/unwrap, must_use_candidate allows and comments from the QUIC config code.
• Versions: mqtt5 0.43.0 (new public fields on the two config structs are breaking for struct literals), mqttv5-cli 0.29.1, mqtt5-wasm 2.1.1; cli and wasm require mqtt5 0.43.

Tests

quic_transport_limits.rs checks that each setting takes effect:

• Stream limit 2 on the broker: a client can open only 2 uni streams (20 with the default).
• Stream limit 2 on the client: the server can open only 2 uni streams toward it (20 with the default).
• Broker stream window 2048: a 64 KiB burst on one stream makes the client send STREAM_DATA_BLOCKED (frame_tx.stream_data_blocked > 0); 0 with the default window.

Removing any of the five places that apply these settings (the broker wiring and acceptor for each broker setting, and the client transport) makes a test fail. The offload flag has a delivery-only test. quic_stats_sampling.rs checks the CSV header, one file per connection, and that the client's STREAM_DATA_BLOCKED frames are counted; removing the sampler or reading the wrong counter fails it.

quinn 0.11 never sends STREAMS_BLOCKED, so frame_tx.streams_blocked_uni is always 0; the stream-limit tests assert the number of streams that could be opened instead.

cargo make ci-verify: 2590 passed, 0 failed. Clippy pedantic clean. A CLI broker started with all three flags delivered 20/20 per-publish QUIC messages.