state: timeout + capacity eviction for PendingBuffer (#40)

[intendednull]

Summary

• Adds age-based + capacity-based eviction to PendingBuffer so events stuck waiting for a predecessor that will never arrive (partition, offline peer) are dropped instead of accumulating forever.
• Each pending entry now carries an optional insertion timestamp; buffer_for_prev_at(prev, event, now_ms) evicts expired entries first, then enforces the cap. The legacy buffer_for_prev path is retained for callers that can't supply a clock (capacity-only eviction).
• ReplayRole wires its per-server buffer to the timestamped path using SystemTime::now() and surfaces the total pending count via a new pending_count field on WorkerRoleInfo::Replay so operators can monitor backpressure.
• Defaults: DEFAULT_PENDING_MAX_ENTRIES = 10_000, DEFAULT_PENDING_MAX_AGE_MS = 3_600_000 (1h). Configurable via ReplayConfig::pending_max_entries / pending_max_age_ms.

Test plan

• cargo fmt --check
• cargo clippy -p willow-state --all-targets -- -D warnings
• cargo clippy -p willow-replay --all-targets -- -D warnings
• cargo clippy -p willow-common --all-targets -- -D warnings
• cargo test -p willow-state — 184 passed (includes 7 new tests)
• cargo test -p willow-replay — 30 passed (includes 2 new tests)
• cargo test -p willow-worker — 13 passed (unchanged)
• cargo check --target wasm32-unknown-unknown -p willow-state

New coverage:

• Age eviction drops stale entries when a later insert advances the clock past max_age_ms.
• Capacity eviction drops the oldest entry when max_entries + 1 events are buffered.
• Timestamp-less (legacy) entries are immune to age eviction but still subject to capacity.
• pending_count() reflects both eviction policies accurately.
• WorkerRoleInfo::Replay::pending_count is exposed to heartbeat/monitoring consumers.

Closes #40