FanoutTree bootstrap tracker hardening (limits, scoring, rate limiting)

[marcus-pousette]

Parent: #577
Related: #585 (overlay formation metrics + scoring)

Problem

Trackers are global-ish infrastructure and must not become a bottleneck or DoS vector.

Scope

• Bound memory per channel and per announcing peer.
• Rate limit announces and queries.
• Candidate scoring/selection rules (level/freeSlots/bid) and query responses.
• Feedback/redirect semantics so trackers converge quickly when freeSlots is stale.
• Consider splitting tracker into a tiny dedicated service (so bootstraps don’t need full fanout forwarding).

Acceptance

• Tracker memory stays bounded under adversarial or high-churn scenarios.
• Query latency remains stable as channels scale.
• Formation quality improves measurably (attach time/depth/hotspots) without requiring global membership (metrics tracked in FanoutTree overlay formation + maintenance (metrics + scoring + re-parenting) #585).