1.1.0-alpha3: code-review polish bundle

Lands the bulk of the post-1.0.0 code-review should-fix items as
a focused polish pass on top of the alpha1 + alpha2 feature
bundle. No contract changes; the four collector interfaces, the
beacon payload envelope, the cwv_beacons / cwv_probes / cwv_events
schemas, the AsyncContextStore service contract, and the
CwvPanelWeight constants all remain stable.

Highlights:

- cwv-version Server-Timing entry on every response (operator-
  verifiable shipped version regardless of JS aggregation).
- hook_requirements status-report rows for trusted-proxy posture
  and max_rows guard.
- Time-series event overlay on daily counts panel.
- enforceMaxRows correctness (id-based delete) and performance
  (information_schema cheap-check).
- CollectorRegistry and CwvAsyncDecoratorBase now log swallowed
  exceptions to the cwv watchdog channel.
- Probe correctness: per-iteration observed_at, split connect/
  total timeout budget, multibyte-safe + bounded token
  normalisation, SSRF defence (http(s) scheme only).
- BeaconController hardening: random_int instead of mt_rand,
  url userinfo+fragment strip, byte-safe URL truncation, alias-
  manager-aware route resolution.
- InstrumentedCacheBackend::getMultiple records as a single
  batched observation with full elapsed time (was apportioning
  micros / requested which rounded to 0 on fast backends).
- cwv_page_attachments skips admin and AJAX routes.
- js/cwv.js: bfcache pageshow handling, URL fragment strip +
  2048-char cap, sendBeacon-return-value falls through to fetch
  keepalive.
- Defensive bounds on hottest_* strings + iterator
  materialisation in CollectorRegistry.
- Doc consistency: CwvPanelContributionInterface PHPDoc weight
  constants and docs/collector-contract.md BeaconRequest helper
  list.

Items deferred from alpha3 per the review's recommendation
(schema-affecting refactors, settings-form server-side validation,
RenderTreeInstrumentor value-object refactor, AsyncContextStore
last-writer-wins doc / dead  arg cleanup) land in subsequent
1.1.x patches or as separate issues.

See ROADMAP.md for the full 1.1.0 entry; SECURITY.md and
PERFORMANCE.md unchanged from 1.0.1; docs/collector-contract.md
gets the BeaconRequest helper-list correction.