P2: Rate limit token-bucket tests + config knobs

[heidi-dang]

Rate limiting exists (token bucket). Add tests and configuration knobs.

Acceptance:

• Unit tests: refill, burst, steady-state
• Config knobs (env/config): enabled, capacity, refill_rate
• Defaults conservative and documented.