Direct race: deadline for unchosen candidates, and count closing native sockets across races #3243

Follow-up from the review of #3222 (Fixes #3209) at head 99133d1. Both reproduced in memory.

1. Overflow candidates can lock another device out of its replacement sessions (server/relay/admissions.ts:66). With devices A and B each holding four chosen sessions, A can authenticate three more race candidates and keep them alive without opening streams (no post-authentication deadline; keepalives answered). The shared count reaches 11 and every new B candidate is closed at over > 3, although B may replace its own oldest session. Give unchosen candidates a short deadline after authentication and count them per device key.
2. Native socket accounting ignores sockets still closing (src/lib/relay/transport.ts:369). The two-socket budget is local to one openDirect call; losers of an earlier race or a probe can still hold the iOS/Android plugin's slots, so the next probe or race is refused (too_many) and not retried when they close. Track open-or-closing native sockets across calls, or retry refused carriers when a slot frees.