Api rate limiting

[gloskull]

Motivation

• Provide a deterministic, dependency-free per-tenant token-bucket limiter suitable for API gateways and service front doors to enforce fair usage and avoid noisy-neighbor throttling.
• Meet operational targets from issue API Rate Limiting with Per-Tenant Token Buckets #73: low critical-path latency, clear monitoring surface, and safe defaults for availability and security.

Description

• Add src/rate_limit.rs implementing RateLimitConfig, TenantRateLimiter, TenantBucket, BucketSnapshot, RateLimitMetrics, and RateLimitDecision with saturating refill math, per-tenant isolation, retry-after calculation, and defaults (DEFAULT_REFILL_RATE_PER_SECOND, DEFAULT_BURST_CAPACITY, CRITICAL_PATH_P99_BUDGET_MS, AVAILABILITY_TARGET_BPS).
• Export the module from the crate by adding pub mod rate_limit; in src/lib.rs so consumers can embed the limiter via sorosusu_contracts::rate_limit.
• Replace the prior placeholder timing checks with a focused test suite in tests/rate_limit_test.rs that validates burst enforcement, tenant isolation, capped refill, retry-after rounding, clock-regression safety, snapshots/metrics, and invalid configuration rejection.
• Add operational documentation RATE_LIMITING_ISSUE_73.md describing architecture, monitoring/alerting fields, blue-green/canary rollout runbook, and security notes for tenant ID handling.

Testing

• Ran cargo test --test rate_limit_test and all rate-limiter unit tests passed (8/8 tests OK).
• Ran cargo test for the full suite which exercised the crate; the new rate-limit tests passed but the overall run failed due to existing pool_manager Soroban storage tests that require env.as_contract() (17 failing tests) and are unrelated to the rate-limiter changes.

Closes #73