Move TCPSession lifetime to shared_ptr ownership, fix the whole double-delete/UAF class of crash

Every crash root-caused earlier tonight (Subscription::subscribers,
TCPServer::sessions, the Socket::write()/eventReceived() re-arm race) was
the same underlying shape: some thread calling a method - or Thread::run()
calling delete - on a TCPSession* while another thread concurrently freed
that same object, because nothing actually guaranteed the object stayed
alive for the duration of a call. Mutex-based patches at each individual
call site kept narrowing the window without closing it (confirmed live,
repeatedly, via AddressSanitizer under concurrent load - each fix produced
a new, different crash signature at the same underlying race), and adding
more locks around every write() call also works against the fifo-based
design's own goal: no thread should have to block just to hand a message
to another thread's session.

TCPSession now derives from std::enable_shared_from_this<TCPSession> and
exposes pin() - a safe upgrade from a stored raw pointer to a real,
ownership-extending shared_ptr, returning nullptr instead of throwing once
the object's real owner has let go. TCPServer::sessions is now the one
real strong-owning shared_ptr<TCPSession> per live session; every other
place that stores a TCPSession* (Subscription::subscribers, Zephora's own
sessionsByPlayerName, GroupObject's membership list, etc.) is just a
non-owning observer and must pin() before touching the object.

A second, distinct problem: Thread::run()'s epoll dispatch starts from a
raw void* of unknown validity. An early version of this fix used
dynamic_cast<TCPSession*> to identify session objects before calling
pin() - confirmed live via AddressSanitizer that dynamic_cast itself
segfaults on a stale pointer, since it has to read the (potentially freed)
object's own vtable to work at all. TCPSession::tryGet()/TCPServer::
isKnownListeningSocket() replace that: both look the raw pointer up as a
key in a registry, never dereferencing it for the check itself - safe to
call on any value, live session, immortal listening socket, or fully
freed garbage alike.

Verified via an AddressSanitizer-instrumented build under sustained
concurrent load (up to 15-way parallel connect/subscribe/create/disconnect
cycles, multiple rounds, 100+ total connections) with zero errors, then
against the real production build with a genuine 500-connection load test
(463/500 succeeded; the rest hit the process's own file-descriptor
ulimit under peak burst, an unrelated and separately deferred tuning
matter, not a crash).

Files touched: TCPSession.h (enable_shared_from_this, pin(), the tryGet()
registry), TCPServer.h/.cpp (sessions as shared_ptr, isKnownListening
Socket() registry, lock made protected for subclasses), Thread.cpp (the
whole dispatch rewrite), Subscription.cpp/SubscriptionManager.cpp (every
subscriber write() site now pin()s first), ConsoleServer.cpp (logSend()
was iterating `sessions` with no lock at all - fixed alongside the type
change it needed anyway).

SubscriptionManager.cpp

@@ -58,10 +58,15 @@ namespace core
                {
                   for (auto subscribed = subscription->subscribers.begin(); subscribed < subscription->subscribers.end(); subscribed++)
                   {
-                     if ((*subscribed)->alias == session.alias)
-                     {
-                        subscription->subscribers.erase(subscribed++);
-                     }
+                     // pin() before reading .alias - a raw subscriber
+                     // pointer here could already be mid-destruction or
+                     // fully freed on another thread (see
+                     // TCPSession::pin()'s own doc comment).
+                     if (auto safe = (*subscribed)->pin())
+                        if (safe->alias == session.alias)
+                        {
+                           subscription->subscribers.erase(subscribed++);
+                        }
                      subscription->subscriptionOwner(session.alias, "*NEXT");
                   }
                }
@@ -150,8 +155,12 @@ namespace core
          // fix for "find a session by the player name they typed"
          // isn't possible at this layer without a larger change; this
          // stops the crash without pretending to fix that gap.
-         TCPSession *tempSession = session.server->getSessionByAlias(&invitee);
-         if (tempSession == NULL)
+         // getSessionByAlias() now returns an already-pin()'d
+         // shared_ptr - see its own doc comment - so tempSession itself
+         // guarantees the session stays alive for this write() call
+         // below, no separate pin() needed.
+         auto tempSession = session.server->getSessionByAlias(&invitee);
+         if (!tempSession)
          {
             coreutils::Log(coreutils::LOG_DEBUG_1) << "invite: could not find session for " << invitee;
             return 0;