fix(peer): cap public control and extractor concurrency

Limit server-wide decoded control requests to 16 and gate Stream Install providers behind a separate two-slot semaphore. The provider permit remains held through producer cleanup, bounding concurrent unrar work while ordinary bulk transfers retain their own capacity.

Test Plan:
- just test (passed after rerunning one transient ETXTBSY failure)
- just fmt (Rust formatting passed; repository's generated security report still triggers pre-existing rumdl violations)
- git diff --check

crates/lanspread-peer/src/services/stream.rs

@@ -61,6 +61,7 @@ pub(super) async fn handle_peer_stream(
     stream_shutdown: CancellationToken,
     control_permit: OwnedSemaphorePermit,
     bulk_transfer_permits: Arc<Semaphore>,
+    stream_install_permits: Arc<Semaphore>,
 ) -> eyre::Result<()> {
     let (rx, tx) = stream.split();
     let mut framed_rx = FramedRead::new(rx, request_codec());
@@ -94,6 +95,7 @@ pub(super) async fn handle_peer_stream(
                                     source_ip,
                                     framed_tx,
                                     &stream_shutdown,
+                                    &stream_install_permits,
                                 )
                                 .await;
                                 framed_tx = dispatched.writer;
@@ -111,6 +113,7 @@ pub(super) async fn handle_peer_stream(
                                 source_ip,
                                 framed_tx,
                                 &stream_shutdown,
+                                &stream_install_permits,
                             )
                             .await;
                             framed_tx = dispatched.writer;
@@ -229,6 +232,7 @@ async fn dispatch_request(
     source_ip: Option<std::net::IpAddr>,
     framed_tx: ResponseWriter,
     stream_shutdown: &CancellationToken,
+    stream_install_permits: &Arc<Semaphore>,
 ) -> DispatchResult {
     match request {
         Request::Ping => {
@@ -322,10 +326,25 @@ async fn dispatch_request(
         Request::StreamInstall {
             game_id,
             content_id,
-        } => DispatchResult::close(
-            handle_stream_install_request(ctx, game_id, content_id, framed_tx, stream_shutdown)
+        } => {
+            let Ok(stream_install_permit) = Arc::clone(stream_install_permits).try_acquire_owned()
+            else {
+                let mut tx = framed_tx.into_inner();
+                let _ = tx.reset(application::Error::UNKNOWN);
+                return DispatchResult::reset(FramedWrite::new(tx, control_codec()));
+            };
+            DispatchResult::close(
+                handle_stream_install_request(
+                    ctx,
+                    game_id,
+                    content_id,
+                    framed_tx,
+                    stream_shutdown,
+                    stream_install_permit,
+                )
                 .await,
-        ),
+            )
+        }
     }
 }