One tenant can evict other tenants' NAT sessions #721

Summary

Every tenant on an egress shard shares one session table of 65,536 entries for NAT66 and NAT64, with no per-tenant limit. When it fills, the oldest sessions are evicted whoever owns them, so one tenant opening connections fast enough breaks the live connections of every other tenant on that shard.

Tenants also cannot see how many sessions they hold. #684 lists a per-tenant limit and per-tenant visibility as phase 1 goals, and today the shard only counts drops for itself as a whole.

Acceptance criteria

• A tenant at its session limit is refused new sessions, and other tenants' existing sessions on that shard keep working
• A tenant can see its current NAT session count and its limit
• An operator can see which tenant reached its limit and when