closes #354

Summary

Add a rate-limiting guide (docs/rate-limiting.md) covering the sliding-window
algorithm, bucket keying, eviction policies, config-driven window sizing with
live-patch behaviour, a worked 429 example with Retry-After, and recommended
client backoff. Expand src/__tests__/rateLimit.test.ts with middleware
integration tests, boundary edge cases, GC interval cycle coverage, and
resolveClientIp unit tests.

Related Issue

Closes #354

Validation

• npm run build
• npm run lint
• npm test

Checklist

• I kept the change focused on the linked issue.
• I added or updated tests for behavior changes.
• I updated documentation when commands, API behavior, or setup changed.
• I did not commit secrets, tokens, .env files, or private credentials.

Security Notes

N/A — docs and test additions only. No changes to runtime authentication,
authorization, input validation, or secret handling.