Env names in reload diff; monitor shows last VRAM check result; harden control channel against floods

- diffConfig reports the env var names (from new struct tags) instead of
  Go field names, so the reload-env reply names what the user can change
- the monitor's GPU line now shows the game detector's last finding
  (external holders or none) and how long ago the check ran
- control channel: 10s per-connection watchdog (abortive force-close),
  cap of 32 concurrent connections, reload-env rate-limited; command
  read was already capped at 4 KiB

internal/control/control_linux.go

@@ -37,12 +37,24 @@ func Serve(ctx context.Context, h Handler, log *slog.Logger) error {
 			if err != nil {
 				return // shutting down
 			}
-			go serveConn(c, h)
+			uc := unixConn{c}
+			if !serve(uc, h) {
+				uc.ForceClose()
+			}
 		}
 	}()
 	return nil
 }
 
+// unixConn adds an abortive ForceClose to net.Conn: a deadline in the
+// past fails pending and future I/O immediately.
+type unixConn struct{ net.Conn }
+
+func (c unixConn) ForceClose() error {
+	c.SetDeadline(time.Now().Add(-time.Second)) //nolint:errcheck // best effort
+	return c.Conn.Close()
+}
+
 // Ask sends one command to the running service and returns its reply.
 func Ask(cmd string) (string, error) {
 	c, err := net.DialTimeout("unix", sockPath, 2*time.Second)