fix(server): reclaim expired callback rate-limit windows - #77

No actionable comments were generated in the recent review. 🎉

Summary by CodeRabbit

• Bug Fixes
  • Improved callback rate limiting by automatically clearing expired rate-limit windows.
  • Preserved active limits while ensuring expired callback windows no longer affect new requests.
  • Maintained expected webhook method and status responses.

Walkthrough

The callback rate limiter now tracks the next cleanup time and removes expired callback windows at most once per minute before admission checks. Existing retry behavior remains unchanged. Regression tests mock time and verify that expired webhook windows are removed, active callback limits remain enforced, wait-action windows are preserved, and response statuses and retry-after values remain correct.

Merge Risk: ⚪ Minimal · up to 2fac4

Callback rate-limit entries now expire during later admissions while active limits and retry behavior remain intact. The change is ready to merge.

_{Comment @coderabbitai help to get the list of available commands.}