upstream: one absolute per-query budget across queueing and failover

waiting for a slot now spends the query budget; truncated attempts that
expire fault the budget, not the upstream, and are never attributed.
admission sweeps in priority order before blocking. forward zones spend
read_timeout_ms once across udp, truncation and tcp. adds
nxdns_upstream_budget_exhausted_total and a 64-upstream validation limit.

src/web/web_integration_test.zig

@@ -495,7 +495,7 @@ const Env = struct {
             .priority = 1,
             .enabled = true,
             .health = .init,
-            .sem = .{ .permits = self.pool_slots.len },
+            .admission = .{ .permits = self.pool_slots.len },
             .reuse_recoveries = &self.pool_recoveries,
         }};
         self.pool_owner = .{};