fix(gateway): harden streaming settlement and admission

[turgaybulut]

Changes

Provider cleanup can stall usage settlement, synchronous local telemetry can block the request event loop, and exclusive tier-policy locks serialize unrelated tenants. This change bounds cleanup, drains outstanding finalizers during application shutdown, sends redacted community events through a bounded writer, and uses shared tier-policy locks while retaining exclusive account locks.

• Classify stream timeouts from machine-readable provider fields and use the same provider-aware candidate count at admission and settlement.
• Share fragment restoration, bound pending placeholder suffixes, and emit sanitized errors on overflow, including terminal chunks.
• Replace full-capacity expiry scans with a bounded expiration heap and reuse rendered response bytes for optional output hashing.
• Add regression coverage for blocked and failing sinks, cancellation, shutdown, placeholder splits, candidate counts, and PostgreSQL lock concurrency.

Community telemetry drops the newest event when its queue is full, reports drops through metrics, and does not fail successful provider responses. Enterprise accounting remains authoritative. No database migration or dependency change is included.

Validation

• Full suite against disposable PostgreSQL 16 and Redis Stack containers: 837 passed, 4 skipped. Skips are existing checks requiring unavailable historical comparison snapshots.
• PostgreSQL regression verifies concurrent reservations for different tenants on one tier, exclusive same-account access, quota enforcement, and policy-edit locking.
• Lockfile, formatting, lint, type checking, Alembic upgrade/schema drift, both OpenAPI profiles, and git diff --check passed.

The scan-counter migration and CI verification refactor from the review remain outside this PR.