test: use-case coverage + end-to-end smoke test

- tests/test_coven.py: capacity cap (5th rejected, configurable), duplicate
  username, roster frame contents, slot/username freed on disconnect.
- tests/conftest.py: set app.ctx.max_users (fixes fixture vs new server code).
- hh/smoke.sh: one-command e2e — rust unit tests, SRP self-test, boot server,
  rust handshake round-trip, cross-language python decrypt of a rust message.
- hh: drop unused Session.user_id (clean build).

pytest: 85 passed. smoke: PASS.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/conftest.py

@@ -32,6 +32,7 @@ def app():
     app.ctx.admin_token = "test-admin-token"
     from cmd_chat.server.helpers import RateLimiter
     app.ctx.rate_limiter = RateLimiter(max_requests=100, window_seconds=60)
+    app.ctx.max_users = 4
     app.ctx.cleanup_task = None
 
     register_routes(app)