Scope beyond title: allocation counting, refresh and rollback also change.

- Quota semantics extend beyond the PR title: recent reservations count for 15 minutes even with absent/revoked/publish-only links or a released tunnel (S01/S03); old live tunnels without a link now count (S05); old tunnel-less/released rows stop counting even with an active link (S07). Exact cutoff is expired, while a live tunnel still counts at cutoff (S09).
- Re-reserve updates only updated_at to T and returns the stored identity; a revived stale row therefore consumes quota again (R01/C02). The second new request after a fifth pending reservation now hits the per-user override (S13).
- Same-user callbacks/reservations are serialized across independent clients. C01 changes from six committed rows to three; C02 changes from six stale successes to three refreshed successes and three denials. Different users continue independently (C04).
- A typed callback failure or interruption now rolls back the inserted reservation (E02/E03); failed timestamp refresh is restored. The sentinel/interrupt is preserved and a second-client retry commits.
- The new wrapper exposes lock-user and transaction persistence operations. Labelled lock/BEGIN injection and actual deferred COMMIT rejection return errors without a reservation success; unaffected before code has no enclosing boundary (E06/E07). No ambiguous network COMMIT-recovery claim is made.
- No other behavioral difference was confirmed in the captured controls or the provider unit suite. Raw diff also contains environment names, backend PIDs, wall times and scheduling order; these are capture metadata, not behavioral changes. E01 was dropped, so its unique-collision stage change was not exercised.