True sliding-window rate limiting

## Summary
Add an optional sliding-window mode that expires individual spends continuously rather than resetting in one step. Design the storage carefully (bounded size, predictable gas) and document the trade-offs vs the fixed window.

## Acceptance criteria
- [ ] New mode selectable per policy
- [ ] Storage is bounded
- [ ] Tests cover boundary bursts
- [ ] `docs/policy-model.md` updated