fix(channelserver): correct session handler retail mismatches (#167)

Lobby search now returns only quest-bound players (QuestReserved) instead
of all reserved slots, matching retail behavior. The new field is
pre-collected under server lock before stage iteration to respect
Server.Mutex → Stage.RWMutex lock ordering.

Replaced three TODOs with RE documentation from Ghidra decompilation of
mhfo-hd.dll ZZ:
- Log key off-by-one: putRecord_log/putTerminal_log pass size 0 for the
  key field in ZZ, so the stored key is unused beyond issuance
- User search padding: ZZ per-entry parser confirms 40-byte block via
  memcpy(dst, src+8, 0x28); G2 DLL analysis inconclusive (stripped)
- Player count: field at entry offset 0x08 maps to struct param_1[0xe]

server/channelserver/channel_registry.go

@@ -46,13 +46,14 @@ type SessionSnapshot struct {
 
 // StageSnapshot is an immutable copy of stage data taken under lock.
 type StageSnapshot struct {
-	ServerIP    net.IP
-	ServerPort  uint16
-	StageID     string
-	ClientCount int
-	Reserved    int
-	MaxPlayers  uint16
-	RawBinData0 []byte
-	RawBinData1 []byte
-	RawBinData3 []byte
+	ServerIP      net.IP
+	ServerPort    uint16
+	StageID       string
+	ClientCount   int
+	Reserved      int
+	QuestReserved int // Players who left to enter quest stages ("Qs" prefix)
+	MaxPlayers    uint16
+	RawBinData0   []byte
+	RawBinData1   []byte
+	RawBinData3   []byte
 }