fix(security): change pairing lockout to per-client accounting

[agorevski]

Replace global failed-attempt counter with per-client tracking keyed by client identity. This prevents one attacker from locking out all legitimate clients via brute-force pairing attempts.

• Replace global (u32, Option) with HashMap<String, (u32, Option)>
• Add MAX_LOCKOUT_CLIENTS (1000) cardinality bound with expiry-based eviction
• Update try_pair signature to accept client_id parameter
• Update all call sites (gateway, telegram channel)
• Add lockout_is_per_client_not_global regression test

Resolves #603

[github-actions]

PR intake checks found warnings (non-blocking)

Fast safe checks found advisory issues. CI lint/test/build gates still enforce merge quality.

• Missing required PR template sections: ## Summary, ## Validation Evidence (required), ## Security Impact (required), ## Privacy and Data Hygiene (required), ## Rollback Plan (required)
• Incomplete required PR template fields: summary problem, summary why it matters, summary what changed, validation commands, security risk/mitigation, privacy status, rollback plan

Action items:

1. Complete required PR template sections/fields.
2. Remove tabs, trailing whitespace, and merge conflict markers from added lines.
3. Re-run local checks before pushing:
   • ./scripts/ci/rust_quality_gate.sh
   • ./scripts/ci/rust_strict_delta_gate.sh
   • ./scripts/ci/docs_quality_gate.sh

Run logs: https://github.com/zeroclaw-labs/zeroclaw/actions/runs/22187985872

Detected blocking line issues (sample):

• none

Detected advisory line issues (sample):

• none