fix(track): read a late arrival frame before timing it out, so a measured wrong angle is never retried away

- observeArrivalRotation reads the sample before the deadline check and keeps
  a late frame's angle on the timeout result; arrivalAngleViolated then makes
  it final. Regressions: wrong late reveal and wrong late settle, each followed
  by a clean second attempt, still fail; a clean late frame stays retryable.
- Overpass admission tests: a monotonic per-test clock removes order
  dependence on the module-level limiters; the proxy test covers ::1 and
  ::ffff:127.0.0.1 sockets; a new test pins the proxied: upstream bucket.
- Retry edges (wrong on-time reveal, maxAttempts, inclusive 10° limit) and a
  check that every name the track harness imports is exported.
- Docs: nginx needs Host, X-Forwarded-Proto and X-Forwarded-For; Docker bridge
  networking makes every host client one remote peer; list the exact
  forwarding headers; owner misses can also see 503.

changelog.d/1308-overpass-admission-review-fixes.md

@@ -7,7 +7,7 @@
   exhaust the owner's admission. The upstream budget stays shared, so an owner
   cache miss can still be rate-limited (asturksever, #1308).
 - Give the tracking arrival check a wall-clock budget per observed frame and
-  retry only an inconclusive timeout: a measured wrong settle angle is kept
-  through a reveal timeout and fails without retry, so slow software-rendered
+  retry only an inconclusive timeout: a timeout keeps every angle it
+  measured, including a late frame's, and a wrong one fails without retry, so slow software-rendered
   frames no longer fail the check and a real violation is never retried into a
   pass (asturksever, #1308).