Fix RateLimiter bugs for bounty

[alexsuperpremium-collab]

Summary

Fixed two critical bugs in the RateLimiter class:

Bug 1: Off-by-one error in consume()

• Problem: When tokens exactly equaled the cost, consume() incorrectly returned false
• Fix: Corrected the logic to properly handle boundary conditions
• Impact: Eliminates spurious 429 responses under production load

Bug 2: Unbounded token accumulation in refill()

• Problem: Tokens could accumulate beyond maxTokens during idle periods
• Fix: Added Math.min() to cap tokens at maxTokens
• Impact: Prevents excessive burst capacity after quiet periods

Testing

• ✅ All 7 tests pass
• ✅ Both previously failing tests now pass
• ✅ No new dependencies introduced

Bounty Requirements Met

• ✅ consume(cost) returns true when tokens >= cost
• ✅ refill() never sets tokens above maxTokens
• ✅ All existing tests pass
• ✅ Both failing tests now pass
• ✅ No new dependencies

This fix resolves the 5 USD bounty requirement.