feat(backend): keep the Forge listener alive

[sandersonstabo]

Summary

• add a long-lived owning Forge listener loop without rebinding or detached tasks
• preserve typed service-vs-drain failure precedence and narrowly fenced retry behavior
• cover cancellation, idle timeout, admission lifetime, authentication, cleanup, and one-shot compatibility

Verification

• focused backend and listener test build
• 21/21 listener tests
• fresh production and test Clippy
• exhaustive root formatter
• locked/offline Cargo metadata
• exact HEAD/hash/status guards and Bazel shutdown

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Adds a long-lived serve_until_cancel loop to ForgeListener so the listener keeps serving across idle timeouts and retryable authentication failures instead of dropping after a single connection.

• Idle connect timeouts are nonterminal and don't consume admission capacity.
• Only peer Accept/Handshake and credential FamilyMismatch/Rejected auth failures are retryable; all others are terminal service failures.
• Cancellation closes and drains the listener; terminal failures preserve the primary cause even when drain also fails.
• Adds 21 tests covering cancellation, idle timeouts, admission lifetime, authentication, cleanup, and one-shot compatibility.

^{Written for commit 8e83dd5. Summary will update on new commits.}