fix(peer): cap public control and extractor concurrency

Limit server-wide decoded control requests to 16 and gate Stream Install providers behind a separate two-slot semaphore. The provider permit remains held through producer cleanup, bounding concurrent unrar work while ordinary bulk transfers retain their own capacity.

Test Plan:
- just test (passed after rerunning one transient ETXTBSY failure)
- just fmt (Rust formatting passed; repository's generated security report still triggers pre-existing rumdl violations)
- git diff --check

crates/lanspread-peer/src/services/transfer.rs

@@ -438,6 +438,7 @@ pub(super) async fn handle_stream_install_request(
     content_id: ContentId,
     framed_tx: ResponseWriter,
     stream_shutdown: &CancellationToken,
+    _stream_install_permit: tokio::sync::OwnedSemaphorePermit,
 ) -> ResponseWriter {
     log::info!("Received StreamInstall request for {game_id} from peer");
     let mut tx = framed_tx.into_inner();