Budget the sample buffer in samples per signal, under a hard memory limit

--buffer-samples (k/M/G) replaces --buffer-mb: the request is rounded down to a
power of two for every signal and the shared time ring. A separate memory limit
(--memory-limit-mb, a Preferences row, default 8 GiB) halves the plan until the
real ring bytes fit and says so on stderr and in the status line. The per-source
key buffer_mb becomes buffer_samples; an old buffer_mb is ignored.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/config.hpp

@@ -11,7 +11,7 @@
 namespace udpscope {
 
 /// Everything the command line can say. Defaults are the ones the spec names
-/// (200 MB per buffer, 10 ms trigger hold-off) unless the user overrides them.
+/// (10 M samples per signal, 10 ms trigger hold-off) unless the user overrides them.
 struct Config {
   std::string server = "127.0.0.1";   ///< IPv4 dotted quad of the stream source.
   std::uint16_t port = 8000;          ///< UDP port (unicast) or TCP port (multicast).
@@ -40,13 +40,21 @@ struct Config {
   std::string session_host() const;
   std::uint16_t session_port() const;
 
-  /// Size of *each* of the two sample buffers, in megabytes. The application
-  /// always allocates two identical buffers (spec item 1).
-  double buffer_mb = 200.0;
-  /// Whether `--buffer-mb` was given. A stored configuration's buffer size fills in only when the
-  /// flag was *absent*: an explicit flag beats a saved setting, and "not asked" is not the same
-  /// question as "asked for 200".
-  bool buffer_mb_specified = false;
+  /// The sample budget: how many samples to keep for **every acquired signal**, and for the shared
+  /// time ring. The rings are powers of two, so the request is rounded *down* to one (`buffer_ticks()`
+  /// in model.hpp) -- "up to" this many -- and the UI shows both figures. 10 M asks for 8 388 608.
+  std::uint64_t buffer_samples = 10'000'000;
+  /// Whether `--buffer-samples` was given. A stored configuration's sample budget fills in only when
+  /// the flag was *absent*: an explicit flag beats a saved setting, and "not asked" is not the same
+  /// question as "asked for 10 M".
+  bool buffer_samples_specified = false;
+
+  /// The hard ceiling on the ring storage, in MiB, for the whole application rather than per source.
+  /// `plan_partition()` halves the rings until they fit under it, so it can clip `buffer_samples`.
+  /// Default 8 GiB; the preferences carry it between runs and `--memory-limit-mb` overrides it.
+  std::uint64_t memory_limit_mb = 8192;
+  /// Whether `--memory-limit-mb` was given, so the stored preference only fills the gap.
+  bool memory_limit_specified = false;
 
   /// Largest time window the toolbar offers, in seconds. The buffer partition is
   /// sized to hold at least this much time (spec: decimation).