fix: harden concurrency limits and high-RPM runtime paths

Bound request, stream, queue, and shutdown resource lifetimes. Reduce scheduler and Redis hot-path work and isolate database maintenance. Include regression coverage, load probes, and concurrency audit results.

apps/aether-tunnel/src/app.rs

@@ -480,6 +480,7 @@ async fn diagnostics_metrics(
     AxumState(diagnostics): AxumState<DiagnosticsState>,
 ) -> impl axum::response::IntoResponse {
     let mut samples = diagnostics.state.metric_samples().await;
+    samples.extend(aether_runtime::logging_metric_samples());
     let servers = diagnostics.server_contexts.lock().await.clone();
     for server in servers {
         samples.extend(server.metric_samples());

apps/aether-tunnel/src/main.rs

@@ -53,8 +53,13 @@ fn build_command() -> clap::Command {
         .subcommand_negates_reqs(true)
 }
 
+fn main() -> anyhow::Result<()> {
+    let _log_shutdown = aether_runtime::LogShutdownGuard::new();
+    run()
+}
+
 #[tokio::main]
-async fn main() -> anyhow::Result<()> {
+async fn run() -> anyhow::Result<()> {
     rustls::crypto::ring::default_provider()
         .install_default()
         .map_err(|_| anyhow::anyhow!("Failed to install rustls CryptoProvider"))?;