ClientState reserved admission

Trap: one global pre-authentication admission/rate limit looks fair, but arbitrary same-UID clients can consume every slot and deny the legitimate systemd MainPID; a stalled bus can also retain slots. Fix: bound authentication independently and reserve admission capacity for the authenticated MainPID, while keeping ordinary same-UID attempts separately limited.