fix(relay): fail closed when a batch cost exceeds the wire

[albertovincenzi]

Problem

Each item cost is a valid i64, but the relay summed all costs for a counter with unchecked addition. Two individually valid expensive items can exceed the i64 delta supported by kv.incr. Debug builds panic; optimized builds can wrap to a small or negative delta, which may let the batch through for free. The admitted-cost telemetry used the same unsafe accumulation and its lifetime atomic could wrap as well.

Fix

• detect grouped-charge overflow with checked addition
• turn an unrepresentable full charge into a guaranteed refusal, allowing the existing prefix algorithm to select the largest representable ordered prefix
• use checked prefix arithmetic and saturating remaining-capacity subtraction
• saturate admitted-cost telemetry locally and in its lifetime atomic
• add a regression test with two legal costs whose sum exceeds i64::MAX

Dependency

This PR is intentionally based on #9 because the grouped-charge code first needs the shared-key deduplication implemented there. The review diff is one follow-up commit.

Review notes for Alice

The synthetic overflow charge uses delta i64::MAX and caps its max at i64::MAX - 1. That is deliberate: if the declared ceiling itself is i64::MAX, saturation alone would look like an exact fit and incorrectly apply. Once refused, prefix uses the original declared ceiling and admits the first item only.

Verification

• cargo test -p gate-server --lib
• cargo clippy -p gate-server --all-targets -- -D warnings
• cargo fmt --all -- --check
• git diff --check

[alice-viola]

Landed on master via #67 (merge commit 944ee9b) as part of the 62-PR integration — this PR's head commit fc606d7 is an ancestor of master. GitHub could not mark it merged automatically because its base is fix/deduplicate-shared-budget-charge, not master. Closing as landed.