Enforce the 200 friend limit on both users and await request acceptance

[tintinhamans]

• Enforce the 200 friend limit on every path that can grow a friends list: sending a request, accepting a request, and the mutual auto-accept.
• Enforce the limit for both participants, since accepting a request adds an entry to each user's list.
• Check an offline target's count against the database via a new Database.Social.CountFriends query.
• Await friend request acceptance so the database and cache are updated before notifications are sent and the request completes.
• Replace CS8602 warning suppressions with real null checks on the caller's shared user data.

---

The friends limit was effectively advisory. AddFriend notified the client that the
list was full but then carried on and created the request anyway, and
AcceptPendingRequest had no limit check at all, so a user could sit at the cap and
keep accepting incoming requests.

The limit was also one-sided. Because a friendship writes to both users' lists,
accepting a request could push the other user past 200 even when the acting user
had room.

Separately, HelperFunction_AcceptFriendRequest was invoked without await. The
request could return, and the friends-list-dirty notifications could fire, before the
friendship row and cache updates had actually been written.

---

SocialController

• Added a FriendsLimit constant and a RejectIfFriendsListFull helper that notifies
  every session of the user and returns 403 Forbidden.
• Applied that check to AcceptPendingRequest and AddFriend.
• HelperFunction_AcceptFriendRequest now verifies the target has room before creating
  the friendship and returns a bool so callers can respond with 403 and skip the
  friends-list-dirty notifications when nothing was created.
• Hoisted the GetSharedDataForUser lookups into the sign-in guards and reused the
  result, removing the duplicate lookups and the pragma suppressions.

Database.Social

• Added CountFriends, a compiled query for a user's friendship count.
• On a query failure it returns int.MaxValue, so an unreadable count blocks the
  friendship rather than silently bypassing the limit.

---

• POST Friends/Requests/{id} returns 403 when the accepting user is at the limit,
  and also emits SOCIAL_CANT_ADD_FRIEND_LIST_FULL to their sessions.
• POST Friends/Requests/{id} and PUT Friends/Requests/{id} return 403 without
  the websocket message when the other user is at the limit.
• PUT Friends/Requests/{id} no longer creates a pending request once the requester is
  at the limit; previously it warned and continued.