feat: replace custom rate limiter with governor (GCRA, lock-free)

[nfvelten]

Summary

• Replaces Mutex<HashMap<String, Vec<Instant>>> sliding-window rate limiter with the governor crate (GCRA algorithm)
• Enforcement is now lock-free (atomics) and O(1) per check — no Vec::retain on every request, no background cleanup task
• Fixes the root cause of the TOCTOU race tracked in test: large payload and deeply nested JSON rejection #82
• Adds optional rate_limit_burst field on AgentPolicy — defaults to rate_limit for full backward compatibility

Config (new optional field)

agents:
  cursor:
    rate_limit: 30         # requests/min (existing)
    rate_limit_burst: 5    # burst allowance (new, defaults to rate_limit)

Design

• Per-key LimiterEntry (one per agent / tool / IP) stored in RwLock<HashMap> — read lock to clone the Arc, write lock only when inserting a new key; the governor check itself never takes a lock
• AtomicI64 remaining counter + AtomicU64 window-start give O(1) X-RateLimit-Remaining headers via CAS reset every 60s
• Config hot-reload detection: if a stored entry's limit differs from the current policy, it is atomically replaced

Test plan

• cargo fmt --check passes
• cargo clippy -- -D warnings passes
• cargo test --lib — 429 tests pass (includes new burst_config_respected test)
• All 11 existing rate-limit tests pass unchanged

Closes #98

🤖 Generated with Claude Code