serviceability: allow count > max in Device::validate

[ben-dz]

Summary

• Removes the four count <= max invariants from Device::validate (max_users, max_unicast_users, max_multicast_subscribers, max_multicast_publishers) so operators can lower a per-device cap below the live count.
• Admission-time gates in processors/user/create_core.rs continue to reject new users when the cap is hit, so reducing the cap simply prevents further growth and the live count drains through natural churn.
• Restores the pre-fix: add max_user exceeded check #2259 behavior for max_users, and extends the same operator-friendly behavior to the per-type caps added in serviceability: add per-device unicast and multicast user limits #2863.

Why

Today doublezero device update --max-multicast-subscribers N (or any of the other caps) fails with MaxMulticastSubscribersExceeded whenever the current count exceeds N — making the cap a hard floor at the live count. There's no graceful way to shrink a cap. The structural invariant in validate() duplicates the admission check at user creation time; only the admission check meaningfully gates behavior, so removing the structural one is safe.

Example on testnet:

$ doublezero --env testnet device update --pubkey 6E1fuqbDBG5ejhYEGKHNkWG5mSTczjy4R77XCKEdUtpb --max-multicast-subscribers 1
Program log: Max multicast subscribers exceeded: multicast_subscribers_count = 2, max_multicast_subscribers = 1
Error: Max multicast subscribers exceeded

Testing Verification

• Updated the two unit tests that asserted the old behavior (test_state_device_validate_error_max_users_exceeded, test_max_users_exceeded) to instead assert that validate() succeeds when count > max for all four caps.
• Ran integration tests in device_test.rs (11 pass) and user_tests.rs (6 pass) to confirm nothing else relied on the structural invariant.

[ben-malbeclabs]

LGTM