address review round 7: IPv6-mapped candidate keys, unique per-run test IPs, diagnostic ambiguity errors

- candidate keys now cover ::ffff:-mapped spellings: the server keys
  counters on the raw client-IP string (only eligibility normalizes), so
  IPv6-mapped connections produce keyless_requests:::ffff:... keys
- forwarded IPs are unique per run (TEST-NET-3 with run entropy) so
  day-scoped request/credit counters from earlier runs can never trip the
  daily limit under a test that hard-requires 200
- the ambiguity error now distinguishes none-bumped (not treated as
  keyless / keyed outside the candidate set) from multiple-bumped
  (concurrent traffic or keyless_* flush) and lists candidates checked