API follow-on: bounded worker admission and scoped usage controls

[wilkont]

Scope

Separate follow-on candidate based on frozen PR #7 source 7d3a93f; PR #7 and its branch remain unchanged. This is a draft source change, not production qualification.

• Bound accepted connection workers before parsing.
• Add project-scoped bounded logical usage/audit purge; no physical or backup deletion claim.
• Record authenticated refusals and observed pre-header cancellation once, without request payloads.
• Measure request-local CLM, structured deliberation and text-provider transport attempts, including failed attempts and SSE. Counts are not GPU completions or billing.
• Preserve scoped-key identity, recommendation-only behavior and execute HTTP 501.

Verification

178 local tests PASS, zero skips, including official SDK fixtures. Two-axis source review completed; metering omission corrected with authenticated failure-path regression. Focused independent review tests pass. Selected production modules pass strict Pyright; existing CLM JSON typing findings remain documented.

Open qualification

Managed TLS, encrypted storage/backups, copy deletion and auditing, deployed scheduler/alerts/monitoring, live no-payload checks, Avori staging acceptance, exact-candidate image scans and host/runtime qualification remain open. No merge, deployment, collection, production tenant, release tag or public promotion is requested by this draft.