upstream: one absolute per-query budget across queueing and failover

waiting for a slot now spends the query budget; truncated attempts that
expire fault the budget, not the upstream, and are never attributed.
admission sweeps in priority order before blocking. forward zones spend
read_timeout_ms once across udp, truncation and tcp. adds
nxdns_upstream_budget_exhausted_total and a 64-upstream validation limit.

src/upstream/owner.zig

@@ -500,7 +500,7 @@ const Upstreams = struct {
                 .priority = server.priority,
                 .enabled = true,
                 .health = .init,
-                .sem = .{ .permits = entry_slots.len },
+                .admission = .{ .permits = entry_slots.len },
                 .reuse_recoveries = &self.recovery_counters[self.used],
             };
             self.used += 1;