feat(api): add rate limit config CRUD with hot-reload and audit trail

[testersweb]

Summary

Adds a REST API to manage rate limit configurations across global, service-tier, and per-user scopes. Configurations persist in PostgreSQL, hot-reload into in-memory limiters without a service restart, and every mutation is recorded in the tamper-evident audit_events hash chain.

What changed

• New rate_limit_configs table (db/rate_limits.sql)
• CRUD endpoints under /api/v1/rate-limits/configs
• Audit listing endpoint at /api/v1/rate-limits/configs/audit
• ServiceRateLimiter middleware for X-Service-ID tier limits
• DynamicRateLimiter::set_global_limit() / reset_global_limit() for hot-reload
• Audit store (src/audit/store.rs) with transactional hash-chain append
• Startup hydration from DB in main.rs
• CI applies db/rate_limits.sql and db/audit_events.sql
• Integration tests for CRUD, hot-reload, validation, and audit chain verification

API endpoints

Method	Path	Description
GET	/api/v1/rate-limits/configs	List configs (?scope_type=global|service|user)
GET	/api/v1/rate-limits/configs/:id	Get one config
POST	/api/v1/rate-limits/configs	Create config
PUT	/api/v1/rate-limits/configs/:id	Update config
DELETE	/api/v1/rate-limits/configs/:id?actor=...	Delete config
GET	/api/v1/rate-limits/configs/audit?limit=50	List audit entries

Key implementation details

• Scopes: global → global IP limiter; user → tenant limiter via X-Tenant-ID; service → service tier via X-Service-ID
• Hot-reload: config is applied to live limiters immediately after the DB transaction commits
• Audit: config mutations and audit rows commit atomically; hash chain verified in tests
• Bootstrap safety: /api/v1/rate-limits/configs/* paths are exempt from rate limiting

Test plan

• Apply schemas: db/rate_limits.sql, db/audit_events.sql
• cargo test rate_limit_config --all-features
• cargo clippy --all-targets -- -D warnings
• Verify CRUD via API (create → update → delete)
• Confirm hot-reload: user/service/global config changes affect 429 behavior without restart
• Confirm audit entries appear and hash chain verifies

Notes

• CRUD endpoints currently have no auth — operator authentication should be added before production use.
• Existing status endpoints (/api/v1/rate-limiter/status, /api/v1/tenant-rate-limiter/status) remain for runtime observability; this API is the configuration source of truth.

Related Issue

Closes #241