[BUG] p2c inflight counter leaks on downstream cancellation (no doOnCancel/doFinally)

- severity: Medium
- files: `shenyu-plugin/shenyu-plugin-proxy/shenyu-plugin-divide/src/main/java/org/apache/shenyu/plugin/divide/DividePlugin.java:133-135`
- description: For `loadBalance=p2c`, `responseTrigger` (which calls `upstream.getInflight().decrementAndGet()`) is wired only via `.doOnSuccess(...).doOnError(...)`. There is no `.doOnCancel(...)`/`.doFinally(...)`. When the downstream subscriber cancels before terminal signal (client disconnect, timeout cancellation), neither `onSuccess` nor `onError` fires, so the decrement never runs. `inflight` ratchets upward forever.
- impact: Persistent inflight inflation on client disconnects; affected upstream is increasingly starved by p2c.
- suggested_fix: Replace `.doOnSuccess(...).doOnError(...)` with `.doFinally(sig -> ...)` (or add `.doOnCancel(...)`).
- confidence: Medium
- related_existing: none — #6544/FUNC-D2 is the `beginTime` race, not the p2c inflight leak.

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/06-medium-tiers.md`](docs/scan2-2026-08-02/06-medium-tiers.md)._

Start in shenyu-plugin/shenyu-plugin-proxy/shenyu-plugin-divide/src/main/java/org/apache/shenyu/plugin/divide/DividePlugin.java at lines 133-135, and trace how responseTrigger is attached for loadBalance=p2c. Verify the inflight counter is decremented after downstream cancellation as well as success or error, and add or update coverage for the cancellation path if the surrounding tests provide one.

Written by the indexing model from the issue text.