Refine DoS protection and other security/performance concerns

Implements the per-group lifecycle and DoS protection (Step 8 of #435, plus caps referenced from #446).

Scope

DoS caps on peer-initiated groups (match go-libp2p defaults)

• peerInitiatedGroupLimitPerTopic = 255 (across all peers, per topic).
• peerInitiatedGroupLimitPerTopicPerPeer = 8 (per (topic, peer)).
• Over-cap behaviour: log and drop the RPC. No disconnect. No score penalty (match go-libp2p; revise if spec adds guidance).

TTL + heartbeat GC

• GroupState.ttlInHeartbeats, default minimum 3.
• Decrement each heartbeat; GC on ttl == 0 or peerStates empty.
• Reset TTL on any publishPartial(topic, groupId, …) call for the group.

Cleanup hooks

• Peer disconnect → remove peerStates[peer] entries across all groups.
• Local unsubscribe from a topic → drop all group state for that topic.

Performance / safety

• GroupState must be a plain HashMap (not thread-safe), accessed only on the pubsub event loop. Do NOT use ConcurrentHashMap (PR #433 had this wrong).
• Limits exposed on GossipParams or the handler config.

Reference

Design: docs/partial-messages.md §6 (lands with the first PR on #435).
go-libp2p: partialmsgs.go:255 (heartbeat), :335-348 (peer-initiated cap).

Start with docs/partial-messages.md §6 and the partial-message implementation around GroupState, publishPartial, heartbeat, peer disconnect, and unsubscribe handling. Compare the limits and heartbeat behavior with go-libp2p's partialmsgs.go:255 and :335-348; done means the caps, TTL garbage collection, cleanup hooks, and event-loop-only HashMap access are implemented and tested.