feat: add tower rate limiting on public API routes (Closes #26)

[ZacLou]

Closes #26

Changes

Adds in-memory token bucket rate limiting to public API routes:

• rate_limit middleware: Simple sliding-window rate limiter keyed by X-Forwarded-For header
• Configuration: RATE_LIMIT_REQUESTS (default 100) and RATE_LIMIT_WINDOW_SECS (default 60)
• Response: Returns 429 Too Many Requests with retry_after_secs when limit exceeded
• Metrics: Increments waveflow_api_rate_limited_total counter on each rejection
• Disable: Set RATE_LIMIT_REQUESTS=0 to disable rate limiting

Files changed

• crates/api/src/middleware.rs — Added rate_limit middleware function
• crates/api/src/main.rs — Wired into public router (applied before request_id layer)

Behavior

• Each unique client IP gets max_requests per window_secs
• Window resets when window_secs elapses since first request in window
• Admin routes are NOT rate-limited (they have their own API key auth)