### wai-quantum-service: sandboxed workers, and limits no client can multiply

- **Workers run sandboxed** (macOS). Each job's worker runs under `sandbox-exec`: no network,
  no file writes, and no program but itself. It reads its job on stdin and writes its result on
  stdout, so it needs none of them. A flaw in parsing a submitted circuit then reaches neither
  the host's files nor the network nor a shell. The pipes it was given stay writable, and its
  energy is read as before. `WAI_QSVC_SANDBOX=0` turns it off for debugging.
- **An IPv6 client is its /64.** Limits were counted per address, and a subscriber is usually
  given a whole /64, so rotating through it handed out fresh limits with every request. A
  client is now an IPv4 address or an IPv6 /64. An IPv4 address carried in IPv6 counts as
  itself.
- **One client holds at most one job's worth of memory.** Three active jobs from one client
  could hold the whole 96 GiB budget. A client's queued and running jobs may now hold together
  at most `WAI_QSVC_CLIENT_GB`, by default the size one job may take. Any client can still run
  its largest job, and no client holds the rest.
- `GET /v1` and the MCP server publish `memory_per_client_bytes`. `GET /v1` also publishes how
  a client is counted and whether workers are sandboxed.

