fix(web-crdt): bound the reconnect + re-handshake retry storm

[Rasbandit]

Bounds the web CRDT reconnect / re-handshake retry storm. main today has an unbounded scheduleRehandshake (no attempt cap, no backoff) and an unthrottled resyncOpenDocs, so any socket hiccup turns into a self-amplifying loop: the reconnect re-enrolls every open doc, each failed handshake re-fires every ~1s forever, and each of those can trigger another reconnect.

This is the client-side half of the amplification class that produced the 2026-07-09 pool-exhaustion loop and open p0 #983.

What it does

• Exponential backoff on scheduleRehandshake, capped at 30s.
• Circuit breaker at 6 consecutive attempts, logged loudly so a stuck note stays diagnosable.
• resyncOpenDocs throttle — one re-enroll per 3s window. A reconnect storm fires socket.onOpen many times per second; one re-sync recovers, the rest is pure amplification.
• Clears a note's backoff on a successful crdt_msg ack.

Revival notes (2026-07-26)

Originally parked from a worktree cleanup (branched 2026-07-17, no PR). Since revived:

• Rebased onto main (clean).
• The parked body's audit note was wrong. It claimed PR test(e2e): retarget hibernate fan-out test for the persistent-doc CRDT model #1120 obsoleted this by rewriting the client on the Relay model. test(e2e): retarget hibernate fan-out test for the persistent-doc CRDT model #1120 is a merged e2e test retarget; the Relay rewrite was the plugin (Settings: dedicated "Connections" page (sessions + accounts + authorized apps) #331). frontend/src/crdt/session.ts was never rewritten, so this fix is live and unmerged.

Second commit: keeping the breaker escapable

Review of the parked commit found a real defect in it. The only thing that cleared rehandshakeAttempts was the ack path — and an ack only fires when we push. A note whose handshake never succeeds never acks, so the breaker latched open and the note stayed deaf for the rest of the session. That trades a storm for the deaf-note class this repo has already fought twice. The doc comment even claimed a reopen or reconnect re-armed it; neither touched the map.

Three exits added, each with a regression test verified to fail without it:

• resyncOpenDocs clears the whole map (new connectivity epoch — mirrors the plugin's clearStrandHealAttempts() on onCrdtTopicJoined; the 3s throttle stops this from self-amplifying).
• closeDoc clears the note's budget, so a user reopen is a genuine retry.
• handleFrame clears on receipt — any inbound frame proves the room is alive, covering a read-only note that never acks.

Verification

• vitest run src/crdt/session.test.ts — 26/26. With session.ts reverted, exactly the 3 new tests fail.
• Full frontend suite: 153 files / 922 tests pass.
• biome ci clean, tsc --noEmit clean.