fix(remote): bound outgoing queues and recover after overflow

[Juliusolsson05]

A paired client that stops reading currently retains unbounded queued output in main (#804). Every server writer now shares a 4 MiB per-socket budget; overflow terminates that socket, while healthy clients continue receiving ordered frames. A reconnect resets the phone's disconnected transcript window and backfills durable history so gaps larger than a page cannot silently disappear.

Fixes #804

Acceptance criteria and decisions

• Broadcasts, replies and bootstrap use the same byte budget. Bootstrap awaits each write so a healthy replay larger than the budget can complete.
• History replies preserve a contiguous suffix and matching offsets under 3 MiB; excluded older records remain pageable. An individually oversized record returns a visible error without a retry loop.
• Disconnect invalidates stale history replies and resets/reloads viewed windows. Semantic suffixes wait for a fresh turn boundary; durable completion remains authoritative.
• Pending prompt outcomes remain uncertain; reconnect never resends mutations. Old socket events and disposed reconnect timers cannot revive the client.
• Real paused/draining sockets, reconnect across multiple pages and prompt uncertainty have regression coverage.

Validation and evidence

• 105 remote tests / 12 files pass, including actual socket backpressure, 80 cached screens totaling over 4 MiB, and reconnecting across 310 durable entries with exact older-page reconstruction.
• Typecheck, test contract, remote production build and diff check pass. Both full CI gates pass after the main rebase.
• Before: audit synthetic paused receiver queued 31.5 MiB and remained open. After: regression verifies queued bytes never exceed 4 MiB and the healthy receiver gets all 160 test frames in order. This establishes a bound, not production memory savings.

Tradeoffs and scope

Disconnect/reset is the recovery contract rather than silently dropping ordered deltas or maintaining a second queue. An interrupted uncommitted semantic turn can temporarily disappear until durable completion; an individual history record above 3 MiB must be viewed on desktop. Existing remote bundle size/mixed import warnings remain. No provider, worktree, desktop rendering or toolkit changes. The #805 retention PR (#814) depends on this branch because it shares transcript lifecycle code. No merge is authorized.

Current validation: rebased onto main f7507980 (toolkit #812 and MCP repair #818), head 205eb9dd. Source changes from the earlier implementation are preserved; both required CI gates pass on this head (CI run). No merge is authorized.