Contract fixes from wiring a client against #1

[Zakkaus]

Stacked on #1: the first four commits are #1 unchanged, only 668be4d is new here. It resolves every item in the review on #1 (comment 5679072758). npm run check:contract passes: 25 tests, 62 examples; source/openapi.yaml is regenerated by the bundle step only.

Examples and schemas

• /connections example: totals match the listed entries.
• flow-23 carries tcp-01HZX4K8W5's connection id, tuple and start; the unrelated interleaved example is flow-24/tcp-24. Test added.
• OperationCommon.result and RouteStepData.input: additionalProperties: true, so generators keep the refined result and input shapes (checked with openapi-typescript: successful-operation results are typed again; flipping it back also fails redocly's example validation). Test added.
• stale_until prose matches the schema (required, string or null).
• POST /probes gets its own queue-full 503 with a required positive Retry-After; the shared Unavailable is unchanged. Test rejects a missing or zero header.

Additions a dashboard needs

• TrafficSummary.sampled_at (required, nullable), rates.window_seconds defined relative to it; runtime-status.md says there is no history and that connection sums are not usage.
• Exact filters: src on GET /connections (IP literal, applied before limit; totals and truncated relative to it) and connection_id on GET /flows (instance-scoped, no tuple guessing).
• GroupSummary.config_revision, the same opaque string as the detail.
• node.health unique by (transport, purpose, measurement, ip_version); node-latency.md states the single-column rule.
• SelectionPathItem.member_name, SelectionCandidate.member_name / leaf_node_name: sanitized names captured at decision time, null when unavailable; ids stay authoritative.

Prose

• events.md: the CORS request-header list for everything the client sends, and preflight handling without bearer auth.
• datapath.md: what active/degraded mean for kind: userspace, and what mock may claim.
• Cursor binding and recovery for /nodes and /dns/cache (common.yaml description plus both docs).
• connections.md: the supported per-device derivation and its limits.

The example and additionalProperties parts are independent of the rest; drop any hunk that goes further than wanted.

[Zakkaus]

Third commit adds what the dashboard comparison on #1 asked for: chain / chain_source, rule_id / rule_expression / rule_source, ingress and domain_source on both Connection and FlowSummary; GET /runtime/outbounds mirroring honk's Clash /stats counters; GET /runtime/traffic/history from a bounded ring buffer with capability-advertised limits; explicit no-close and out-of-scope sentences. Gate: 30 tests, 68 examples.