api: derive multicast subscriber/publisher counts from live users

[armcconnell]

Resolves: #650

Summary of Changes

• Derive per-device multicast subscriber/publisher counts from live dz_users_current data instead of the stale on-chain multicast_subscribers_count / multicast_publishers_count fields on dz_devices_current. In production those on-chain fields are frequently 0 even when a device has active subscribers, so DZDs showed 0 subscribers and 0 available capacity (appearing oversubscribed) despite real users.
• A multicast user counts as a subscriber when its subscribers array is non-empty and as a publisher when its publishers array is non-empty; a user that does both counts in each.
• Applied consistently across the device list/detail, metro list/detail, contributor detail, and facility rollup so the whole multicast section agrees. Aggregate pages sum the live per-device counts, and the effective-max capacity is floored at the live count.
• No frontend change: the web reads the same JSON fields, which now carry correct values.

Diff Breakdown

Category	Files	Lines (+/-)	Net
Core logic	4	+102 / -40	+62
Tests	4	+315 / -0	+315
Total	8	+417 / -40	+377

Small, focused query changes in four handlers; the bulk of the diff is new handler tests.

Key files (click to expand)

• api/handlers/metros.go — replace on-chain sub/pub counts with a device_multicast_live CTE in both the list (shared const) and detail queries
• api/handlers/facilities.go — sum live per-device counts in the facility rollup CTE
• api/handlers/contributors.go — sum live per-device counts in the contributor detail query
• api/handlers/devices.go — extend the multicast CTE to compute live sub/pub counts for the device list and detail

Testing Verification

• Added handler tests (test-first) covering a device whose on-chain counts are 0 but which has activated multicast users that subscribe, publish, or both; asserts the API reports the live counts (e.g. 4 subscribers / 3 publishers), and that metro/facility aggregates sum correctly across devices.
• Pending multicast users are excluded; a both-roles user is counted in both subscriber and publisher totals.
• Full api/handlers package test suite passes.