Deposit capacity limits net instead of gross deposits

[tim-barry]

Closes: #265

Description

Withdrawing from the token reserve refills the deposit capacity for both the individual position and the token as a whole, so that the deposit capacity tracks net deposits rather than gross deposits.

• Per-position (per-user) deposit limit cannot grow beyond the maximum (depositCapacityCap * fraction)
• Overall token deposit limit can temporarily grow beyond the depositCapacityCap over the regeneration period (one hour) before the limit is reset to the capacity. This means that excess deposit limit generated by withdrawals is regularly reset to the baseline rather than accumulating indefinitely over time (which would allow steady withdrawal followed by sudden large deposit amounts).