fix(server): prevent one caller exhausting the global live-team registry

Problem

Service.CreateTeam limits the live-team registry only with the process-wide MaxTeams check (len(s.teams)). One authenticated tenant can create cheap zero-member teams up to that limit and leave them uncleaned, preventing every other tenant from creating a team until registry entries are removed or the process restarts.

Caller ownership is being addressed separately in acc/caller-separation. This issue must follow that work so quota accounting uses the verified owner identity (Issuer, Subject), not Subject alone or an ad-hoc team-specific identity.

Scope

• Add a configurable per-owner live-team limit keyed by verified (Issuer, Subject).
• Retain MaxTeams as the process-wide circuit breaker.
• Maintain per-owner accounting atomically under Service.mu across successful creation, cleanup, and shutdown removal paths.
• Define the compatibility behavior when OwnershipEnforced is false; do not silently aggregate all legacy callers as one authenticated owner.
• Add regressions proving:
  • one caller is rejected after exhausting its own quota;
  • another caller can still create a team when the first caller has exhausted only its quota;
  • the same subject from different issuers has independent quota buckets; and
  • cleanup frees capacity only for the owning caller.

Out of scope

• The ownership/authorization fix itself (owned by acc/caller-separation).
• TTL-based reaping.
• The similar global ErrTooManySessionEngines cap, which needs separate scoping.

Start at Service.CreateTeam and Service.mu, then follow the cleanup and shutdown removal paths alongside the acc/caller-separation work to verify the owner identity used for quota accounting. Done means the listed regressions pass: per-owner rejection, independent callers and issuers, and cleanup freeing capacity only for the owner.