fix(shared): ConnectionLimiter retains zero-count map entries on Release (memory leak)

Problem

ConnectionLimiter in packages/shared/pkg/connlimit tracks and enforces per-key concurrent connection limits. When connections are acquired and subsequently released back to zero, Release(key) decrements the counter to 0, but never removes the key entry from the underlying concurrent map (smap.Map[*atomic.Int64]).

For long-running proxy nodes (client-proxy and orchestrator/pkg/tcpfirewall) handling high request volume across ephemeral client IPs or sandboxes, inactive keys remain permanently allocated in memory with count 0, causing steady memory accumulation over time.

Root Cause

Release(key) decrements counter.Load() to 0 via CompareAndSwap(current, current-1) but lacks eviction logic when current - 1 == 0. Calls to Remove(key) are only manually issued upon sandbox deletion in orchestrator, leaving generic HTTP proxy and TCP firewall IP keys orphaned forever.

Reproduction Steps

1. Acquire and release 10,000 unique keys using TryAcquire(key, limit) followed by Release(key).
2. Inspect limiter.connections.Count().
3. Observed result: Count() returns 10000 (10,000 zero-count map entries retained).
4. Expected result: Count() returns 0.

limiter := connlimit.NewConnectionLimiter()
for i := 0; i < 10000; i++ {
    key := fmt.Sprintf("key-%d", i)
    limiter.TryAcquire(key, 5)
    limiter.Release(key)
}
// limiter.connections.Count() remains 10000

Technical Context

• Files affected: packages/shared/pkg/connlimit/limiter.go, packages/shared/pkg/connlimit/limiter_test.go
• Subsystem: Shared / Client Proxy / Orchestrator TCP Firewall
• Impact: Medium (Memory accumulation on edge proxy nodes)

Proposed Changes

Start with packages/shared/pkg/connlimit/limiter.go, especially Release and the concurrent map operations, then read the related cases in packages/shared/pkg/connlimit/limiter_test.go. Run the connlimit tests and reproduce the 10,000-key scenario. Done means released keys no longer remain in the map while existing limit and concurrent-release behavior still passes.