fix: survive transient accept() failures instead of exiting

[tobez]

do_accept() croaked on any accept() failure, so transient errors — fd
exhaustion (EMFILE/ENFILE) or a client aborting mid-handshake
(ECONNABORTED) — took the whole daemon down. In production deployments
under fd pressure this turns a momentary resource blip into a full outage.

Now recoverable errno values (EINTR, ECONNABORTED, EAGAIN/EWOULDBLOCK,
EPROTO, EMFILE, ENFILE, ENOBUFS, ENOMEM) get a throttled warning
(new LTC_ACCEPT_FAILURE standalone category, reusing the log-throttling
machinery from #29) and the daemon keeps serving; anything else still
croaks, since remaining accept() errno values indicate programming errors.

Known trade-off: while EMFILE persists the listener stays readable and the
event loop spins; that transient CPU cost is strictly better than exiting,
and a reserve-fd accept-then-close scheme was deliberately left out (YAGNI).

Test plan:

• new t/accept-failure.t: daemon under RLIMIT_NOFILE=16 driven into
  EMFILE — logs the warning, stays alive, keeps serving the existing
  connection, and accepts new clients once fds free up
• make test (full suite)
• scan-build clean