feat(server): pool allowance slots across personhood collections

[TarikGul]

Every ring read in the allowance path is scoped to a PersonhoodCollection, which carries the collection identifier, the transaction-extension variant, and the per-collection budgets. Registration pools slots across every collection the
device can prove membership in.

A person with full personhood holds a second membership whose alias space is entirely separate, with its own budget. Pooling makes that capacity reachable, so a full People table no longer reports no free StatementStore slot while seqs sit free in LitePeople.

Behaviour

• Collections are tried widest budget first, so a full person spends People before LitePeople.
• A free slot in any collection is taken before any live slot is evicted. Eviction revokes an allowance someone is using, so it happens only once every collection is full.
• When everything is full, the slot replaced is the globally oldest replaceable one across all collections. A preselected takeover still counts against the one-revocation-per-registration limit, so a duplicate-submit retry gives up rather than evicting a second slot, and a refused takeover is named as ReplacementRefused.
• protected is scoped per collection, because the same seq in two collections is two unrelated slots.
• Exhaustion reports the summed budget, including when raised by the inner rescan.
• PGAS claims are scanned against the budget of the collection they are proved against: Asset Hub declares Pgas.MaxClaimsPerPeriodPerPerson alongside MaxClaimsPerPeriodPerLitePerson.
• Each collection resolves independently. One whose ring storage is unreadable, whose exponent has no proof domain, or whose budget this chain does not declare is logged and skipped, so a device that can only prove light personhood still gets its allowance. An error is raised only when every candidate failed, which keeps an RPC outage from being reported as "not a member".
• The existing-allocation check covers every collection before any ring snapshot is fetched. That keeps the established-product path off the ring pages, and stops a target holding a slot in one collection from being handed a second one in another.

alloc-check reports both collections' member keys, ring indices, and slot tables.

Live

Paseo People spec 1000032 and Asset Hub spec 2000036:

live People: slots=20 ring_exponent=9 current_ring_index=0 extension_variant=0
live LitePeople: slots=10 ring_exponent=9 current_ring_index=14 extension_variant=1
live pooled budget=30
live AsPgas: Claim=0 People=0 | Claim=0 LitePeople=1
live PGAS claims per day: People=100 LitePeople=40
alloc-check → People: free seq=0 | LitePeople: free seq=2

Collections[People].ring_size decodes, so the space-padded collection identifier
addresses a real entry rather than silently reading nothing. The battery's
allowance rows (Resource Allocation/request, auto_signing_e2e, all four
Statement Store rows) pass, so a real registration goes through end to end.