Env names in reload diff; monitor shows last VRAM check result; harden control channel against floods

- diffConfig reports the env var names (from new struct tags) instead of
  Go field names, so the reload-env reply names what the user can change
- the monitor's GPU line now shows the game detector's last finding
  (external holders or none) and how long ago the check ran
- control channel: 10s per-connection watchdog (abortive force-close),
  cap of 32 concurrent connections, reload-env rate-limited; command
  read was already capped at 4 KiB

internal/control/control.go

@@ -7,6 +7,13 @@
 // triggers, so the worst a local user can cause is a cheap, throttled
 // check and a GPU-idle-gated restart onto a signed binary.
 //
+// Abuse hardening: the command read is capped (4 KiB), each connection is
+// force-closed after connTimeout so a stalled client cannot pin a goroutine
+// (or a Windows pipe instance) forever, and concurrently served connections
+// are capped at maxConns — beyond that, connections are closed on arrival.
+// On Windows the pipe's ACL additionally denies network logons, so the
+// channel cannot be reached from another machine.
+//
 // Protocol: the client writes one command line, the server answers with
 // one reply line ("OK ..." or "ERR ...") and hangs up.
 package control
@@ -17,6 +24,7 @@ import (
 	"fmt"
 	"io"
 	"strings"
+	"time"
 )
 
 // CmdUpdateNow asks the service to check for, stage and (once the GPU is
@@ -37,9 +45,50 @@ var ErrUnavailable = errors.New("control channel unavailable")
 // line. It must start with "OK " or "ERR ".
 type Handler func(cmd string) string
 
+// connTimeout bounds one connection's lifetime: a client that stops
+// mid-command or never reads the reply would otherwise pin its goroutine
+// (and on Windows one of the pipe instances) indefinitely. A var so tests
+// can shrink it.
+var connTimeout = 10 * time.Second
+
+// maxConns caps concurrently served connections; beyond it, new
+// connections are closed on arrival. Bound on the goroutines a local
+// flood can pile up.
+const maxConns = 32
+
+var connSem = make(chan struct{}, maxConns)
+
+// serve dispatches connection handling under the concurrency cap. It
+// returns false when the cap is reached — the caller must then close the
+// connection itself.
+func serve(c io.ReadWriteCloser, h Handler) bool {
+	select {
+	case connSem <- struct{}{}:
+		go func() {
+			defer func() { <-connSem }()
+			serveConn(c, h)
+		}()
+		return true
+	default:
+		return false
+	}
+}
+
+// forceCloser is implemented by connections that can be torn down
+// abortively, unblocking pending reads and writes (Windows pipe:
+// DisconnectNamedPipe; unix socket: a deadline in the past). The
+// connection watchdog uses it; normal closes still flush the reply.
+type forceCloser interface {
+	ForceClose() error
+}
+
 // serveConn runs the line protocol on one accepted connection.
 func serveConn(c io.ReadWriteCloser, h Handler) {
 	defer c.Close()
+	if fc, ok := c.(forceCloser); ok {
+		timer := time.AfterFunc(connTimeout, func() { fc.ForceClose() })
+		defer timer.Stop()
+	}
 	line, err := bufio.NewReader(io.LimitReader(c, 4096)).ReadString('\n')
 	cmd := strings.TrimSpace(line)
 	if cmd == "" {