fix(shared): ConnectionLimiter retains zero-count map entries on Release (memory leak)

Empieza por packages/shared/pkg/connlimit/limiter.go, especialmente por Release y las operaciones concurrentes sobre el mapa, y después lee los casos relacionados en packages/shared/pkg/connlimit/limiter_test.go. Ejecuta las pruebas de connlimit y reproduce el escenario de 10,000 claves. Se considera terminado cuando las claves liberadas ya no permanecen en el mapa, mientras el comportamiento existente del límite y de la liberación concurrente sigue pasando.

Problem

ConnectionLimiter in packages/shared/pkg/connlimit tracks and enforces per-key concurrent connection limits. When connections are acquired and subsequently released back to zero, Release(key) decrements the counter to 0, but never removes the key entry from the underlying concurrent map (smap.Map[*atomic.Int64]).

For long-running proxy nodes (client-proxy and orchestrator/pkg/tcpfirewall) handling high request volume across ephemeral client IPs or sandboxes, inactive keys remain permanently allocated in memory with count 0, causing steady memory accumulation over time.

Root Cause

Release(key) decrements counter.Load() to 0 via CompareAndSwap(current, current-1) but lacks eviction logic when current - 1 == 0. Calls to Remove(key) are only manually issued upon sandbox deletion in orchestrator, leaving generic HTTP proxy and TCP firewall IP keys orphaned forever.

Reproduction Steps

1. Acquire and release 10,000 unique keys using TryAcquire(key, limit) followed by Release(key).
2. Inspect limiter.connections.Count().
3. Observed result: Count() returns 10000 (10,000 zero-count map entries retained).
4. Expected result: Count() returns 0.

limiter := connlimit.NewConnectionLimiter()
for i := 0; i < 10000; i++ {
    key := fmt.Sprintf("key-%d", i)
    limiter.TryAcquire(key, 5)
    limiter.Release(key)
}
// limiter.connections.Count() remains 10000

Technical Context

• Files affected: packages/shared/pkg/connlimit/limiter.go, packages/shared/pkg/connlimit/limiter_test.go
• Subsystem: Shared / Client Proxy / Orchestrator TCP Firewall
• Impact: Medium (Memory accumulation on edge proxy nodes)

Proposed Changes