feat: cover the registered-address rejection in the metrics catalog

5.0.0 gained static-IP agent registration (#38446): remoted now rejects a
peer whose address does not satisfy its client.keys `ip` column, and skips a
client.keys line whose `ip` column does not parse. Both arrived as behaviour
the metrics catalog could not report.

The rebase merged cleanly and hid two accounting gaps:

- AuthError::AddressNotAllowed had no cell of its own, so countRejection()'s
  `default:` filed every address rejection under
  remoted.auth.reject.malformed -- the wrong cause, in the one family whose
  whole purpose is naming the pre-collapse reason behind the generic 401.
- A client.keys line skipped for an unparseable `ip` column left only a WARN;
  nothing in /metrics showed that an agent had become unauthenticable.

Adds remoted.auth.reject.address_not_allowed and, as the companion level to
`agents`, remoted.auth.keystore.entries_skipped -- the lines the adopted load
could not use (bad field count, non-numeric id, unparseable ip, undecodable
key), deliberately excluding comments, blanks and removed entries.

The funnel test claimed to feed "every enum value" but used a hand-written
list, which is exactly how the gap survived. It now carries a static_assert on
the last AuthError enumerator, so changing the enum breaks the build instead of
silently widening the `malformed` bucket, plus a sum invariant proving every
rejection fed lands in exactly one cell.

Docs, module README, monitor.py and the graphics generator follow the two new
names; the inventory-sync metrics page links 5.0.0's new
session_query_batch_size from the session-duration rows it governs.
remoted.control_keepalive_throttle gets no metrics cross-link: no metric
isolates its effect, and inventing one would be worse than the silence.