Replace O(n) Array.shift() with batch filter() in both check() methods.
Add cleanup() method to both limiters for proactive stale entry eviction.
Add size getter to both limiters for memory observability.
Add remove() method to createConnRateLimiter for API parity.

The per-client rate limiter (1-second window) and per-IP connection rate
limiter (60-second window) now:
- Use batch filter() instead of shift() for O(1) amortized check()
- Expose cleanup() to remove all stale entries in one pass
- Expose size getter (windows.size) for monitoring
- Remove keys entirely when no active timestamps remain

Closes: issue-03-rate-limiter-memory-leak