- add max_replay_messages (default 100000) and validate it
- startup refuses an unbounded replay while preserving outbox for operator action
- integration test: bound 2 rejects 3 messages, relaxed bound recovers all
- docs/test count updated to 58