fix(overpass): keep proxied traffic out of the direct-loopback admission reserve; keep a measured arrival-angle failure through a reveal timeout

- /api/overpass: a loopback socket with forwarding headers (a local reverse
  proxy) is admitted from the remote pool under a socket-keyed proxied: bucket,
  never the owner's direct-loopback window; the upstream limiter uses the same
  key. Regression: owner cache hits survive an exhausted proxy bucket.
- Arrival check: a reveal timeout keeps the settle angle it measured; the new
  observeArrivalRotationWithRetry retries only inconclusive timeouts, so a
  real violation cannot be retried into a pass. Regression: wrong settle angle
  -> reveal timeout -> clean second attempt still fails.
- SECURITY.md, README, changelog and CURRENT-STATE: scope the guarantee to
  admission isolation, name the forwarding headers a local proxy must send,
  and state that the upstream budget stays shared.

changelog.d/1308-overpass-admission-review-fixes.md

@@ -1,8 +1,13 @@
 - Keep Overpass-backed layers working behind a reverse proxy: `/api/overpass`
   now uses the keyless same-site gate, admits forwarding headers and still
-  refuses cross-site requests; loopback keeps its own admission window and
-  IPv6 peers are keyed by /64, so a few LAN peers cannot lock the owner out
-  (asturksever, #1308).
+  refuses cross-site requests. Direct loopback requests keep their own
+  admission window; proxied requests, including those a local reverse proxy
+  relays over loopback, are admitted as remote traffic keyed by their socket,
+  and IPv6 peers are keyed by /64, so neither LAN peers nor proxied users can
+  exhaust the owner's admission. The upstream budget stays shared, so an owner
+  cache miss can still be rate-limited (asturksever, #1308).
 - Give the tracking arrival check a wall-clock budget per observed frame and
-  retry an inconclusive timeout, so slow software-rendered frames no longer
-  fail it (asturksever, #1308).
+  retry only an inconclusive timeout: a measured wrong settle angle is kept
+  through a reveal timeout and fails without retry, so slow software-rendered
+  frames no longer fail the check and a real violation is never retried into a
+  pass (asturksever, #1308).