Fix credit lease review findings

[bpapillon]

Follow-up to review findings on the C# port of credit leases (schematic-csharp #195). Four of them apply here:

• Server-mode check-and-reserve now sends ceil(usage) as the hold quantity. The settle bills whole units, so a 2.5 check held 2.5 × rate and then billed 3 × rate. Covers the sync and async clients.
• A reservation with an empty lease id is no longer refunded on consume or sweep, in either store. In Redis an empty pin turns off the lease check, so the refund landed on whichever lease held the slot. Every SDK sharing a Redis has to agree on this.
• A caller that joins an in-flight extend now checks the result against its own requirement. The flight re-checks only against its starter's need, so it could skip the wire call and leave the joiner short.
• A check now sets its deadline once, at the start, and caps its acquire and extend joins against it. Before, each join got a fresh timeout, and acquire joins had no cap at all.

Not applicable here: holding a lock across store or wire calls (asyncio, no locks around them), the datastream poller leak (start() can't raise after starting the poller), naive expiry timezones (already read as UTC), the drain busy loop (each pass awaits), and lease listing on close (already wrapped).