fix: close panics and races the audit's own fixes left nearby

Second-pass review of the 54-commit self-correcting audit. Each item below
was confirmed by reading the surrounding source (and, where practical, the
pre-fix code) before being changed; regression tests are included for every
behavioral fix.

Concurrency:
- eventbus: Bus.Subscribe called wg.Add with no synchronization against a
  concurrent Bus.Stop's wg.Wait, a real "WaitGroup misuse" panic risk (e.g. a
  Telegram-bot settings save racing panel shutdown/restart). Stop now flips a
  mu-guarded `stopped` flag before waiting, and Subscribe checks it under the
  same lock, so Add and Wait can no longer race.

Security:
- login_limiter: evictForRoom's fallback eviction picked an arbitrary map
  key, including ones still under an active cooldown - an attacker flooding
  /login with fresh usernames could evict their own (or anyone's) blocked
  record and reset the lockout. The fallback now skips actively-blocked
  records, only falling back to an unconditional evict if the map is
  somehow entirely full of active blocks (preserves the hard memory cap).

Subscription-endpoint panics (reachable by any client hitting /sub):
- internal/sub/service.go: applyPathAndHostParams/Obj (ws/httpupgrade/xhttp
  with no path settings object) and the TLS alpn readers in three places
  used unchecked type assertions - exactly the bug class abab7cd0 patched
  elsewhere in the same switch statements, just not these call sites.
- internal/sub/json_service.go, clash_service.go: the externalProxy loops
  in the JSON and Clash generators used unchecked assertions on a
  legacy/admin-supplied field (missing "port", non-object entry, etc.).
- internal/sub/json_service.go: realityData's shortId/serverName selection
  could assert a non-string array element.

Other correctness:
- client_traffic.go: ResetAllTraffics (touched by 3eb214d0) still skipped
  clearing NodeClientTraffic node-sync baselines, unlike its sibling reset
  paths in the same file - a node's next sync would re-add pre-reset delta
  on top of the freshly-zeroed counter.
- inbound_traffic.go: the traffic-tick tx's Commit/Rollback errors were
  silently discarded; now logged so a backend-level commit failure (e.g. an
  aborted Postgres tx from a best-effort helper) doesn't masquerade as a
  successful tick.
- outbound_subscription.go: the new subscriptionFetchClient doc comment was
  wedged between fetchAndStore's existing comment and fetchAndStore itself,
  leaving fetchAndStore undocumented and the comment describing the wrong
  function.

Convention cleanup:
- Removed narrative // comments added by the audit that violate this repo's
  no-inline-comment rule (mostly narrating the specific bug/fix rather than
  a lasting contract, and mostly on new Test functions, which this repo's
  existing tests never comment) - calibrated against this exact codebase's
  own pre-existing comment style so legitimate godoc-style doc comments
  were left alone.

internal/eventbus/bus.go

@@ -29,11 +29,12 @@ type subscriber struct {
 // Producers call Publish (non-blocking) and every event is fanned out to all
 // subscribers; per-event filtering is the subscriber's responsibility.
 type Bus struct {
-	ch   chan Event
-	subs []*subscriber
-	mu   sync.RWMutex
-	done chan struct{}
-	wg   sync.WaitGroup
+	ch      chan Event
+	subs    []*subscriber
+	mu      sync.RWMutex
+	done    chan struct{}
+	wg      sync.WaitGroup
+	stopped bool
 }
 
 // New creates a Bus with the given buffer size. Use 0 for DefaultBufferSize.
@@ -57,6 +58,9 @@ func New(bufSize int) *Bus {
 func (b *Bus) Subscribe(id string, handler func(Event)) {
 	b.mu.Lock()
 	defer b.mu.Unlock()
+	if b.stopped {
+		return
+	}
 	for i, s := range b.subs {
 		if s.id == id {
 			close(s.quit)
@@ -159,8 +163,13 @@ func safeCall(fn func(Event), e Event) {
 
 // Stop shuts down the bus: the dispatch loop and every subscriber worker exit
 // after finishing any handler already in progress, and any events still buffered
-// or queued may be dropped. Safe to call once.
+// or queued may be dropped. Safe to call once. After Stop returns, Subscribe is
+// a no-op — this also keeps Subscribe's wg.Add from ever racing with Wait below,
+// since both are serialized through mu.
 func (b *Bus) Stop() {
+	b.mu.Lock()
+	b.stopped = true
+	b.mu.Unlock()
 	close(b.done)
 	b.wg.Wait()
 }

internal/eventbus/bus_test.go

@@ -260,3 +260,17 @@ func waitDone(wg *sync.WaitGroup) <-chan struct{} {
 	}()
 	return ch
 }
+
+func TestBusSubscribeAfterStopIsNoop(t *testing.T) {
+	b := New(4)
+	b.Stop()
+
+	b.Subscribe("late", func(Event) {})
+
+	b.mu.RLock()
+	n := len(b.subs)
+	b.mu.RUnlock()
+	if n != 0 {
+		t.Fatalf("Subscribe after Stop registered %d subscriber(s), want 0 (a stopped bus must not accept new subscribers, and must not call wg.Add after wg.Wait has been entered)", n)
+	}
+}