Fixes the root causes of the 1101 error: a failed connection retry could escape as an unhandled error after the connection was established; the debug logger could throw during cleanup and leak a connection slot and socket on every failed probe; an accepted WebSocket that never sent data was held open indefinitely. Also bounds unauthenticated requests (no more stalling the worker or large outbound bursts, which risks a Cloudflare abuse flag), adds IRCF carrier-matched clean IPs (validated as real Cloudflare edges), records connection-level errors in panel diagnostics, and explains why an over-quota user cannot be re-enabled.