Add distributed public ingestion rate limiting - #5

Summary

Adds PostgreSQL-backed abuse controls to the public form ingestion path.

Included

• per-source-IP rate limiting
• per-endpoint rate limiting
• shared enforcement across API processes
• atomic PostgreSQL counter updates
• 429 rate_limit_exceeded
• Retry-After
• configurable limits and windows
• trusted-proxy handling
• hashed/HMAC client-address subjects
• opportunistic expired-counter cleanup
• migration 0004
• real PostgreSQL concurrency coverage

Request ordering

Public submissions are handled in this order:

1. request body size protection
2. source-IP rate limit
3. endpoint resolution
4. endpoint rate limit
5. active-state check
6. form parsing and validation
7. durable submission persistence

This means invalid traffic still consumes source capacity, while guessed nonexistent endpoints do not create endpoint counter rows.

Current limitations

• fixed-window limits allow boundary bursts
• traffic limiting is not spam classification
• deployments behind proxies must configure trusted proxy hops correctly
• unkeyed IP hashing is only obfuscation
• cleanup is opportunistic