fix(pd): add configurable decode capacity admission limit

[sufubao]

Summary

Add a PD-master admission guard that computes the current capacity for every incoming request by summing running_max_req_size across all registered decode nodes. If the Master already has that many in-flight requests, it raises the existing ServerBusyError before multimodal preload, tokenization, or PD-stage waits.

The guard is enabled by default. To explicitly restore the previous behavior, start the PD Master with:

--disable_pd_master_decode_capacity_limit

Motivation

Overload may otherwise be detected only after entering the PD flow and waiting 60s/180s, so clients can wait a long time before receiving 429. Decode nodes already register their complete startup arguments with the Master, and disconnected nodes are removed from decode_nodes, allowing the current node list to remain the single source of truth without a cached capacity value.

This is intentionally temporary:

• counts end-to-end Master requests rather than exact instantaneous D occupancy
• uses the existing static per-D request-count limits; it is not token/KV-aware admission control
• changes no streaming APIs or timeout behavior
• capacity is local to each Master; a global cap across multiple Masters remains the gateway responsibility

Checks

• pre-commit (Black and flake8)
• git diff --check