Realtime decoder cancellation must not free admission early

Reusable engineering lesson from e3-solutions/theft PR #787 (observed 2026-09-04): for short-deadline realtime image decoding backed by non-interruptible native/CUDA work, returning a timeout to the caller and freeing capacity are separate events. Cancel queued work immediately, ignore late results, but retain the active admission slot until underlying native work settles; otherwise apparent cancellation can oversubscribe the service. At the HTTP boundary, cancel pending body reads without destroying the socket before the explicit timeout response flushes. Real-socket regression tests caught the latter as ECONNRESET instead of the intended deadline outcome.