Hard per-app cap on SSH carrier fallback, with a slot kept for short runs

When an app falls back to sharing the user's terminal ControlMaster (e.g. password-only hosts where a separate BatchMode master can't log in), sshd's MaxSessions (default 10) is shared by every app on that connection. Put a hard per-app cap on carrier sessions and queue the overflow. Don't let overflow go to the carrier uncapped after a wait timeout: a burst then lands all at once and refuses the terminal's own reconnect. Long-lived users (language server, waveform helpers) must count toward the cap, but reserve at least one slot for short one-off runs, or a held LSP plus viewer starves file listing entirely. Pick the cap from apps-per-host × (1 + cap) ≤ MaxSessions, and make it one constant.