Enforce one active replication stream per follower keypair

[bmuddha]

Outcome

An authenticated follower keypair can hold at most one active replication stream at a time.

Scope

• Reserve an authenticated follower identity before beginning snapshot or blockstore transfer.
• Reject a concurrent stream that authenticates with an already-reserved keypair.
• Release the reservation on every worker exit path, including handshake, transfer, I/O, cancellation, and shutdown failures.
• Preserve the existing allowlist behavior.
• Preserve shared-key relay behavior, where a node follows an upstream leader and serves downstream followers under its configured local identity.

The allowlist currently validates identity but does not reserve it for the lifetime of a transfer, so a captured handshake can be replayed concurrently within the accepted time window.

This change mitigates concurrent handshake replay by limiting each follower keypair to one active stream. It does not prevent replay after the prior stream disconnects.

Non-goals:

• Challenge nonces or other wire-protocol changes
• Transport encryption
• A global limit on unauthenticated or pre-authentication workers

Acceptance criteria

• A second concurrently authenticated connection using the same allowed keypair is rejected before transfer begins.
• The keypair can connect again after the active stream exits.
• Reservations cannot leak across any worker exit path.
• Existing allowlist and relay scenarios continue to work.