Add load-test harness and money-path backpressure

[kalbliz]

Summary

• Repeatable npm run test:load profiles for authenticated bets, duplicate idempotency keys, concurrent round reads, and overload.
• Money-path overload now returns controlled 429 (rate limit) or 503 (in-flight cap / open circuit breaker) with Retry-After, instead of cascade 500s.
• IP rate limiters key by address (not request objects), so the bet limiter actually fires.

Closes #500

Test plan

• npm run test:load locally (11/11 passed)
• CI load/unit jobs on this PR
• Confirm POST /api/bets/up-down burst returns 429 after the per-IP cap, never 500
• Confirm open Soroban breaker / in-flight cap maps to 503 + Retry-After
• Confirm duplicate Idempotency-Key burst creates one bet

Local npm run test:load sample

[LOAD] bet overload 429
  statuses: 200x3 429x9  errorRate=0.0%
[LOAD] auth bet throughput
  total=16 success=16 fail=0  p95=111ms
[LOAD] duplicate idempotency
  total=16 success=16 fail=0
[LOAD] read rounds throughput
  total=30 success=30 fail=0  p95=30ms