fix(serving): low-severity audit batch findings (paroche/syndesis/archon/akouo)

[forkwright]

Low-severity audit-batch findings across the serving/audio/render crates
(paroche, syndesis, archon, akouo), plus added test coverage.

Rebased onto current main (after the core/acquisition/media batches landed).
The cross-crate pagination fix that several batches touched is resolved to
main's canonical u32 list_requests/count_requests signature; serving's
duplicate i64 variant was dropped. Serving's unique fixes are preserved:

• archon: 16 low-severity audit findings (wave-1 batch) #439 archon parse_search_media_type invalid media_type now maps to a
  400-class ServiceError::InvalidInput instead of Internal (500); coexists
  with main's spawn_blocking config reload.
• syndesis: 6 low-severity audit findings (wave-1 batch) #384 syndesis pairing admission (PairingGate): on/off switch + a
  fixed-window rate limit on is_new pairing attempts, which mint an API key
  for an unauthenticated peer.
• Pagination window/count coverage ported to main's Page::new API.

Gate: kanon gate --full green (fmt, check, clippy -D warnings --all-targets,
nextest 1700/1700, deny, lint).

Closes #383
Closes #465
Closes #384
Closes #439
Closes #437
Closes #436