fix(dashboard): clamped CAS retry loop in snapshot hub connection counter + direct counter tests

Decrement was decrement-first with a single non-retried repair CAS. From zero,
two unmatched decrements (SignalR calls OnDisconnectedAsync for a connection
whose OnConnectedAsync faulted) capture -1 and -2; a real Increment then makes
the count -1, and the first decrementer's stale CompareExchange(0, -1) matches
and resets to zero — erasing a live connection, so the idle gate freezes an open
dashboard. The same lost race also made Decrement report 0 when it had not
written 0.

Clamping now happens inside the compare-and-swap: read, clamp, publish, retry on
loss. A lost race re-reads the fresh value instead of repairing a stale one.

The counter moves to its own file per the one-public-type-per-file convention and
gains direct tests: the zero floor under concurrent unmatched decrements, matched
pairs settling at zero, and an interleaved connect/disconnect stress round. The
stress test asserts the observable invariants only — the specific interleaving
cannot be forced through the public API (verified: the previous implementation
passes it), which its remarks now state rather than implying a reproducer. A hub
wiring test is skipped for the EventsHub reason: driving Hub.OnConnectedAsync
needs caller-clients and connection-context fakes, and the overrides are two
lines of delegation to the tested type.

Also documents that the API-key refresh's pre-gate time check races benignly.

src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardSnapshotService.cs

@@ -294,6 +294,9 @@ public sealed class DashboardSnapshotService : IDashboardSnapshotService
             // Inside the refresh window: reuse the cached summaries rather than
             // re-reading the API key table on this tick. Only a *successful* refresh
             // moves the timestamp, so a failed read is retried on the next tick.
+            // This check is deliberately outside the refresh gate, so it races
+            // benignly: if two callers both read a stale timestamp, the zero-timeout
+            // gate below admits one and the other returns without touching the store.
             return;
         }