sec: GC empty channels and rate-limit subscribe/unsubscribe

[EthanY33]

Summary

Closes the architectural parts of #10. The mechanical channel-name length cap landed in the earlier PR #17.

Two related fixes:

Channel GC

Empty channels were intentionally retained ("NOTE") because of a TOCTOU race: Range over the registry, observing an empty channel, deleting it, but a concurrent GetOrCreate had already returned the same channel reference and a subscriber was about to land on it.

This PR closes that race with registry.Sweep:

1. Walk all channels.
2. For each, take the channel's SubsMu. If Subscribers is empty, set Deleted (atomic.Bool) under the lock, then Delete from the registry.
3. hub.Subscribe reads Deleted under the same SubsMu before adding a subscriber. If Deleted is true, return new error ErrChannelDeleted.
4. handleSubscribe wraps GetOrCreate + Subscribe in a small retry loop (3 attempts). On ErrChannelDeleted it loops; the next GetOrCreate returns a fresh channel (the deleted one is no longer in the registry), and Subscribe succeeds on the new one.

SweepLoop(ctx, reg, interval) runs from cmd/wirefan/main.go at DefaultSweepInterval = 60s.

Subscribe / unsubscribe rate-limiting

The existing per-API-key publish bucket (100/hour, 200 burst) is now also consumed by handleSubscribe and handleUnsubscribe. A peer spamming control frames hits RATE_LIMITED like a peer spamming publishes.

If 100/hour proves too strict for legitimate subscribe patterns, the bucket parameters are still hardcoded at one site (cmd/wirefan/main.go) — adjust there.

What changed

• internal/registry/registry.go: Channel.Deleted atomic.Bool.
• internal/registry/sweep.go: NEW Sweep + SweepLoop + DefaultSweepInterval.
• internal/registry/sweep_test.go: NEW (3 cases).
• internal/hub/channel.go: NEW ErrChannelDeleted; Subscribe checks Deleted.
• internal/conn/handler.go: rate-limit subscribe/unsubscribe; retry loop on ErrChannelDeleted in handleSubscribe; updated comment in handleUnsubscribe.
• cmd/wirefan/main.go: start registry.SweepLoop goroutine.

Test plan

• go build ./... clean.
• go test ./internal/... passes (4 new tests).
• Stress test: client subscribes to 100 random channel names, unsubscribes from all, sleeps 65s, runs gh api ... against /metrics — wirefan_channel_count returns to 0.
• Stress test: tight loop of subscribe/unsubscribe within rate-limit window — observes RATE_LIMITED after ~200 ops (current burst).

Conflict notes

Touches cmd/wirefan/main.go — overlaps with PR #15 (resolveAdminToken) and PR #18 (parseFlags). All three changes are additive (different lines). Whichever lands last needs a trivial three-way merge; the other two can land in any order.