docs(networkstream): correct the payload-residual arithmetic and name the operator lever (SUB-7786)

Addresses matthyx's correction. The residual paragraph said the connection entries
alone breach the message limit at ~3,000 connections and that no tree budget can help
there. The number was right but the attribution and the conclusion were both wrong.

~3,000 is the breach point WITH the tree budget saturated, not entries alone. The
usable budget is 3.75 MiB of JSON (5 MiB after base64 x1.333); at 4,000 connections
entries are 2.02 MiB and saturated trees ~1.91 MiB, so backing the trees out leaves
room for ~2,900 entries. Entries alone would not breach until 3,932,160 / 530 = ~7,400.

That makes "no tree budget can help" the damaging part: trees are roughly half the
payload in that regime, so tightening maxProcessTreeBytes moves the breach point out
toward ~7,400 as the budget approaches zero. As written, an operator whose node was
dropping traffic would have concluded the budget was not a lever when it is the fastest
one available -- no protocol change, no backend coordination. Both numbers are now
tabulated with what each one means.

Splitting the message stays the long-term fix, since tightening the budget buys
headroom by shipping fewer trees -- the attribution this feature exists to deliver.
Recorded one prerequisite before anyone builds it: the container-profile precedent
reacts to a synchronous HTTP 413 from storage's QueueManager, whereas this path posts
elsewhere, handles no 413 anywhere, and the 5 MiB cap is a broker limit whose
enforcement point SUB-7850 lists as unverified. If it is enforced downstream the sensor
sees 200 OK and never learns, so reactive splitting is unavailable and the split has to
be decided before the first send.

Also corrects the 4,000-connection row from 5.72 to 5.24 MiB: it double-counted the
entry cost, adding a modelled 530 B per entry on top of a measured payload that already
contained ~94 B per synthetic entry. Same class of error as the one above -- mixing a
measured figure with a modelled one -- so the table now says which is which.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: Alon <alon@armosec.io>