perf(rdma): enforce process-wide connection budgets

[ketor]

Problem

Per-node idle pool limits bound retained QPs locally but do not cap total live endpoints across nodes or KVClient handles. A wide or changing ring can therefore exhaust QPs, WR slots, or server receive-segment leases.

Change

• reserve endpoint, QP, WR-slot, and remote receive-slot-byte credits before opening a QP
• share one process-wide budget across RdmaTransport instances
• wait with a bounded admission timeout; never oversubscribe
• return credits only after RcEndpoint destruction
• export fixed-cardinality used/limit and timeout metrics
• document resolved controls

Verification

• rdma_resource_budget_test: impossible reservation, bounded timeout, blocked waiter wakeup
• rdma_loopback_test --gtest_filter=RdmaSafety.*

Defaults preserve the measured 0064 peak of 128 active connections with 2x headroom (256 endpoints). No deployment outside 0064 is changed.