feat(host): concurrent punktfunk/1 sessions (bounded by --max-concurrent)

The accept loop no longer awaits each session inline — it spawns each onto a
JoinSet, bounded by a semaphore (--max-concurrent, default 4: a NVENC session
bound; overflow clients wait in QUIC's accept backlog until a slot frees). The
QUIC handshake stays in the accept loop so a failed handshake (e.g. a pin
mismatch where the client aborts) doesn't consume a session slot or block
accepting the next client; the slow part (control handshake, pairing, the
capture/encode pipeline) runs in the spawned task.

Each session already had its own virtual output + NVENC encoder; the
host-lifetime input/audio/mic services stay shared — the natural "multiple
devices viewing/controlling the same desktop" semantic on kwin/mutter/wlroots.
gamescope's independent-desktops (per-session input/audio) isolation is a
follow-up. New M3Options.max_concurrent + the `--max-concurrent` CLI flag.

Validated live (GNOME box): two clients connected at once -> two independent
Mutter virtual outputs (720p60 + 1080p60) streaming simultaneously (39 MB +
48 MB). All 61 host tests green (the c_abi/pairing tests exercise the new loop +
the failed-handshake-doesn't-count semantics).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/punktfunk-host/src/main.rs

@@ -158,6 +158,9 @@ fn real_main() -> Result<()> {
                 max_sessions: get("--max-sessions")
                     .and_then(|s| s.parse().ok())
                     .unwrap_or(0),
+                max_concurrent: get("--max-concurrent")
+                    .and_then(|s| s.parse().ok())
+                    .unwrap_or(m3::DEFAULT_MAX_CONCURRENT),
                 require_pairing: args.iter().any(|a| a == "--require-pairing"),
                 allow_pairing: args.iter().any(|a| a == "--allow-pairing"),
                 pairing_pin: None,
@@ -417,6 +420,8 @@ M3-HOST OPTIONS:
     --seconds <N>                per-session stream duration, virtual source (default: 30)
     --frames <N>                 per-session frame count, synthetic source (default: 300)
     --max-sessions <N>           exit after N sessions; 0 = serve forever (default: 0)
+    --max-concurrent <N>         stream at most N sessions at once (NVENC bound); overflow waits
+                                 in the accept queue; 0 = unlimited (default: 4)
     --allow-pairing              accept PIN pairing ceremonies (arm pairing mode)
     --require-pairing            only serve PIN-paired clients (implies --allow-pairing;
                                  the host logs a 4-digit PIN when a client starts pairing)