fix(backend/copilot): cap concurrent AutoPilot turns per user at 15 (#13064)

## Changes

- New `backend/copilot/active_turns.py` with Redis-sorted-set tracking
of in-flight chat turns per user. Atomic check-and-add via Lua script,
fail-open on Redis brown-out. Stale-cutoff sweep on every acquire so a
crashed turn doesn't permanently consume the cap.
- `backend/copilot/stream_registry.py`: `mark_session_completed` now
releases the user's slot after the CAS succeeds (covers normal
completion, failure, and cancel — all funnel through this path).
- `backend/api/features/chat/routes.py`: `stream_chat_post` calls
`try_acquire_turn_slot` for new turns; on rejection returns HTTP 429
with the user-facing message. Slot is released if `create_session`
raises so the route doesn't leak slots on infrastructure errors.
Anonymous (no `user_id`) sessions skip the gate.
- Unit tests for `try_acquire`, `release`, `count`, fail-open behaviour,
and the 15-cap constant.

## Why

Hard safeguard before paid users land. A single user (typically via the
API) could previously spawn hundreds of concurrent copilot turns before
the cost-based microdollar limiter caught up — vector for abuse and
shared-infra blowback.

This is the **clean hotfix scoped to AutoPilot/copilot turns only** —
graph executions are already per-user-per-graph capped (25, in
`executor/manager.py`) and have pre-charge eligibility checks, so no new
gate there.

Closes [SECRT-2335](https://linear.app/autogpt/issue/SECRT-2335).
Follow-up PR will add the 5-running queue model from
[SECRT-2339](https://linear.app/autogpt/issue/SECRT-2339) on top of
this.

## Targets master

Targeting **master**, not dev — this is a critical security/stability
hotfix that should ship without waiting for the dev train.

## Testing

- [x] Unit tests added for the active-turns module (mocked Redis)
- [ ] /pr-test will exercise the 429 path against the running stack
- [ ] CI

## Checklist

- [x] Filled out the **Changes** section
- [x] Added unit tests for new behaviour
- [x] No out-of-scope changes