Queue an aged exit identity for rotation once nothing is using it

[dipu-bd]

• EXIT_TTL (default 30m) queues an instance for a new circuit once it has
  held one exit identity that long, which is the only thing that pre-empts a
  site quietly scoring an IP: an exit that is unwelcome rather than broken
  never reaches the failure ladder, so the instance keeps it indefinitely.
• A queued instance rotates only when no session is pinned to it, active or
  idle. The clock must not change the exit IP under a caller that asked to be
  sticky, so EXIT_TTL is a floor on an identity's age and SESSION_TTL is what
  frees an abandoned instance.
• One rotation per tick, and none while a pool-wide sweep runs: instances all
  start their clocks together at boot, so a batch is exactly what a naive
  sweep would do on the first tick past the TTL.
• The clock restarts in endRotation, whether the rotation succeeded or not, so
  an attempt against a wedged control port waits another EXIT_TTL rather than
  retrying every tick. Restarts reset it separately, having handed back an
  identity the clock was not measuring.
• Instances report rotate_pending, and the dashboard tags them "rotate
  queued", so a queue held up by its sessions explains itself.