bug(gateway): service forwards and SSH sessions share one per-sandbox cap of 20 relay slots #4472

User Story

I use OpenShell with service forwards and SSH into the same sandbox from several terminals.
I need open forwards not to block SSH access to the sandbox.

Problem Statement

acquire_forward_connection_guard (crates/openshell-server/src/grpc/sandbox.rs:2674-2705) counts token-less TCP service forwards and SSH relays against the same MAX_CONNECTIONS_PER_SANDBOX = 20 (:2739). The cap is a hard-coded constant, and SSH also has a separate per-token cap of 3.

Impact / Why This Matters

Twenty open service-forward connections (one browser tab can open several) leave no slot for SSH, so openshell sandbox connect fails with "sandbox SSH connection limit reached" for every user of that sandbox. Operators cannot raise the limit.

Acceptance Criteria

• SSH relays and service forwards have separate per-sandbox budgets.
• Both limits are configurable in gateway config.
• The error message names which budget was exhausted.

Reproduction Steps

1. Expose a service from a sandbox and open 20 concurrent connections through openshell service forwarding.
2. Run openshell sandbox connect <name>.
3. Observe sandbox SSH connection limit reached.

Suggested UX (if applicable)

No response

Environment

• OpenShell: main @ 6a6401b
• Found by source review; affects all drivers.

Logs