fix(admission): reserve Responses and Messages bodies before clone

[RaviTharuma]

Rebased onto current release/v3.8.50 with no fork-CI commits and no rewrite of chatBodyAdmission.ts.

This closes the gap in #10786: POST /v1/responses, POST /v1/responses/*, and POST /v1/messages still ran withInjectionGuard (unconditional request.clone() + .json()) without the process-wide budget that Chat Completions already uses.

withChatAdmission is a thin composer around the shipped APIs:

• admitChatRequest (process-wide budget + per-session fairness, fix(admission): preserve process-wide bounds across byte-level connection lanes #10110/feat(backend): Per-connection virtual admission lanes for agentic workloads #9654)
• releaseChatAdmissionAfterHandler (lease held through SSE / released on handler failure)

It does not add a second admission controller. Composition is withChatAdmission(withInjectionGuard(postHandler)) so reservation happens before clone.

Tests call the shipped admitChatRequest / ChatAdmissionController / withChatAdmission (second large body -> 503 chat_admission_busy, handler not invoked).

Supersedes closed #10789 (that branch was cut from an older chatBodyAdmission and carried unrelated fork CI). Remaining handleChat aliases are still tracked in #10790.

Refs #10786 #7847

[RaviTharuma]

Follow-up commit also wraps remaining handleChat aliases from #10790 (antigravity, /v1/api/chat, /v1/completions, provider-scoped chat, relay) with the same withChatAdmission composer.

[RaviTharuma]

Rebased onto current release/v3.8.50 via #10828 (f5be5dd). Conflict in src/app/api/v1/responses/route.ts: kept the keepalive rewrite's inline admitChatRequest + createInjectionGuard (wrapping withChatAdmission would double-admit). withChatAdmission still wraps /v1/messages, responses catch-all, and remaining handleChat aliases. Merge is MERGEABLE. Does not merge.

[RaviTharuma]

Admission-local CI on 31ff7d746 (unit 2/4): tests/unit/with-chat-admission-10786.test.ts still required withChatAdmission(withInjectionGuard(postHandler)) on /v1/responses. After the keepalive rebase (#10806), that route inlines admitChatRequest before request.json(); wrapping withChatAdmission would double-admit.

Pushed efaf2ba6c: the source guard now asserts admit-before-json on responses, and still requires the wrapper on /v1/messages plus /v1/responses/[...path].

Not dummy-fixing the sibling FQG trio (mutation-test-coverage / open-sse-typecheck / secrets) or shared unit shards (i18n pt-BR/vi, t06 responses/route.ts on drain HEAD, catalog/combo, translator shim). Those match #10820/#10819 on f5be5dda2. Does not merge.

[RaviTharuma]

Rebased onto current release/v3.8.50 via #10828 (0a09b6a / 4821f9f). Unique admission commits replayed (3/3, no conflicts). HEAD 4c54ca3. Merge remains MERGEABLE. Does not merge.

[RaviTharuma]

Removed the shared #10828 drain commits from this branch so the diff is feature-only again (it had been ~100 files of i18n/catalog/CI dump stacked under the real change). Rebased onto current release/v3.8.50 (4821f9ffd). Does not merge.

[RaviTharuma]

Docs Gates on 0781ec4d failed check:docs-sync (42 docs/i18n/*/llm.txt vs root llm.txt). Unit 1/4 leftovers are the shared release/v3.8.50 set (preserve previous_response_id, Claude cache metadata, SQLite sync-driver specifier, OpenRouter warmup) already drained on #10828.

This PR is admission-only. Not restacking the drain. Does not merge.