feat(BA-7365): add a per-user rate limit middleware to the web server

[jopemachine]

📚 Stacked PRs

This PR is part of a 5-PR stack. Merge in order:

1. ⬇️ feat(BA-7364): deliver the login user id in the auth response #13777 — feat(BA-7364): deliver the login user id in the auth response
2. ⬇️ feat(BA-7365): key the rate limit counter by user id #13778 — feat(BA-7365): key the rate limit counter by user id
3. ⬇️ feat(BA-7362): move the per-user API rate limit to the user resource policy #13779 — feat(BA-7362): move the per-user API rate limit to the user resource policy
4. ⬇️ feat(BA-7363): publish the per-user rate limit to the shared Redis DB #13784 — feat(BA-7363): publish the per-user rate limit to the shared Redis DB
5. 👉 feat(BA-7365): add a per-user rate limit middleware to the web server #13771 — feat(BA-7365): add a per-user rate limit middleware to the web server ← you are here

Only the final tip (#13771) is guaranteed to build / pass CI; intermediate PRs are logical slices for reviewability.

Summary

• Add a web server middleware that counts requests proxied to the manager (/func/*) against the login user's rolling counter and rejects over-limit requests with HTTP 429, so floods no longer consume manager resources (auth DB lookup, Valkey ops).
• The limit is the keypair rate_limit carried in the session; None means counted but never rejected. Unauthenticated requests and sessions from managers that do not send the user id yet pass through unchanged.
• The web server is the primary limiter; the manager-side middleware stays as the fallback for clients that still reach the manager directly. While both paths exist, a proxied request increments the shared counter twice — a transitional cost that disappears once direct manager access is closed off.

Verified against a live cluster (manager + web server on this branch, halfstack Valkey/PostgreSQL): the counter is a single user.<uuid> key; 429 once the counter passes the limit; rate_limit = NULL counted but never rejected; unauthenticated /func/*, non-/func paths and sessions without user_id pass through uncounted; the manager-only path allows exactly rate_limit requests.

Resolves BA-7365.