feat: request-side backpressure via a max_in_flight pool option

[puzza007]

Admission had no bound: a request burst piled into every worker's Reqs map and the C multi without limit, so overload showed up as memory growth and eventual timeouts rather than a signal callers can act on. The new {max_in_flight, N | infinity} pool option (default infinity — existing pools are unchanged) caps concurrently in-flight requests per worker, enforced by a single capacity gate ahead of both the sync and async admission paths.

A full worker replies {overload, self()} without registering anything, and pool_call offers the request to the remaining workers in random-rotation order, skipping the one that just rejected — so a partially-loaded pool always admits, and random routing can't strand requests on a busy worker while others idle. Only when every worker is at its cap does the caller get a fast {error, #{code => overload}}, the signal for shedding load or retrying with backoff. All admission attempts flow through one helper using wpool's own call doors, so the worker-death exit shape is caught in exactly one place: a death on the first attempt still reports worker_died (preserving the #178 semantics and the unknown-pool distinction), while a death mid-spillover just means that worker has nothing to offer.

The option is validated and split from the curl-multi options in katipo_pool:start/3 itself, so a bad value fails the API call with a bad_opts error instead of surfacing as worker-init crashes under wpool, and pool options get an honest pool_opts() type rather than overloading curlmopts(). The model header notes why capacity rejection preserves the verified properties by construction: it restricts admission before a request ever enters Reqs, adding no delivery paths.

Tests cover deterministic fill-via-spillover (two slow requests occupy both workers of a size-2, cap-1 pool), sync and async overload rejection, capacity recovery after a cancel, and bad-option rejection at pool start. 198 tests, dialyzer, xref, and lint pass.

Stacked on #183 (alias-routed commands) → #182 (streaming) → #180 (timeout abort); merge bottom-up and I'll rebase each layer as the one below lands.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Vf2gxZLpxT4HvBfZKCgP3g

[codecov]

Codecov Report

❌ Patch coverage is 93.75000% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 78.16%. Comparing base (eebb5e6) to head (2244db0).

Files with missing lines	Patch %	Lines
src/katipo.erl	93.75%	1 Missing ⚠️
src/katipo_worker.erl	85.71%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #184      +/-   ##
==========================================
+ Coverage   77.79%   78.16%   +0.37%     
==========================================
  Files           9        9              
  Lines        1342     1365      +23     
==========================================
+ Hits         1044     1067      +23     
  Misses        298      298              

Flag	Coverage Δ
c	78.16% <93.75%> (+0.37%)	⬆️
erlang	78.16% <93.75%> (+0.37%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.