feat: add rate limiting for song requests

[jakebromberg]

⚠️ Superseded

This PR has been split into smaller, focused PRs for easier review:

PR	Description	Lines	Base
#125	Discogs API client	~1,100	#122
#138	Rate limiting	~500	#125
#139	Enhanced request line + AI + Artwork + Slack	~3,000	#138

Merge order

main
└── #62:  Request line endpoint
    └── #122: Anonymous device auth
        └── #125: Discogs client
            └── #138: Rate limiting
                └── #139: Enhanced request line

Merge in order: #62 → #122 → #125 → #138 → #139

---

Original description

Summary

• Registration rate limit: 5 per hour per IP
• Song request rate limit: 10 per 15 minutes per device
• Configurable via environment variables for testing
• Automatically disabled in test environment