fix(token-usage): bound every background wait at the pause cap

Two pacing gaps:

- Serialized reservations could stack past THROTTLE_MAX_PAUSE, so one
  sweep sleep could grow without bound while fresh notifications and
  drains waited behind it. Reservations are now granted only up to a
  now+cap horizon; pause that does not fit is refunded to the debt
  ledger (its work equivalent) rather than forgiven, so the duty cycle
  still holds while no caller ever waits past one capped pause.
- A drain request arriving as the last sweep task finished suppressed
  that task's deferred reconcile with nothing rescheduling it until
  the next 30-minute sweep tick. The settle check now also runs after
  drain handling, extracted as settle_flags_if_drained and shared by
  both arms.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>