feat(rustd): §4 and §6 — mint, bundles, memory, sweepers, metrics

Closes the runner plane's remaining verbs and its background half. Routes go
mounted=13 tabled=80: every runner-plane verb is now served.

§4 — credentials, bundles, memory. The order inside the mint IS the security
property: lease → grant → write gate → vault → exchange. `moka`'s
`or_try_insert_with` is cache and single-flight in one, so `broker_flight.zig`'s
mutex, poll loop, loser timeout and residual-key cleanup have no counterpart
here; `try` keeps refusals OUT of the cache. The cache key is a derived `Hash`
over canonical JSON and one SHA-256, replacing 201 lines of hand-rolled framing.
Rotation write-back locks, compares and writes in ONE transaction, where
`oauth_refresh.zig` does read/compare/write unlocked and silently loses a
reconnect that lands mid-mint.

§6 — one generic sweep loop serves all four sweepers. Cancellation is a
`tokio::select!` against the sleep rather than an atomic polled every 100 ms, so
shutdown is immediate; `interval()` is re-read every tick, which is what lets
retention shorten its own gap. The reclaim consumer name is shared with the
lease path — claiming into a name nothing reads would re-strand exactly what it
rescued. The 4096-series metric bound replaces 327 lines of CAS slot table.

Two defects found by running suites that had been written and never run are
fixed here rather than in a follow-up, because both are defects in THIS code:

  - Every vault read was broken. `workspace_id` is a `uuid` column and was
    compared against a text-bound parameter, with a doc comment asserting the
    column was `text` and deliberately omitting the cast. Harmless under the
    Zig driver, which sends an untyped parameter Postgres infers; fatal under
    sqlx, which binds `&str` as `text`. Fixed in all four statements.
  - A memory-window fixture sized only `content` where `entry_bytes` charges
    key + content + category, so "half the budget" was 524 of 1024.

§4 and §6 are ONE commit and could not be two. Their changes interleave in the
exhaustive match arms of `afd_fleet::error::classify` and in three `mod` lists;
a §4-only commit would carry match arms for §6 error kinds that do not exist
yet and would not compile. Splitting them means rewriting the code, not staging
it differently.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>