✨ feat(infra): add declarative limits management via YAML and Lambda provisioner (#405)

[sodre]

Summary

• Add declarative limits management allowing operators to define rate limits in YAML files and apply them idempotently via a Lambda provisioner, similar to Terraform's plan/apply workflow
• Introduce zae-limiter limits CLI command group with plan, apply, diff, and cfn-template subcommands for managing limits declaratively
• Add zae_limiter_provisioner Lambda package with manifest parsing, diff engine, applier, and handler supporting both CLI invocations and CloudFormation Custom Resource events
• Add #PROVISIONER state record in DynamoDB to track managed vs unmanaged limits, enabling safe removal of limits deleted from YAML without clobbering manual overrides
• Extend CloudFormation template with the limits provisioner Lambda function and export its ARN for cross-stack reference
• Add get_provisioner_state() / put_provisioner_state() to Repository and sk_provisioner() key builder to schema

Test plan

• Unit tests pass: manifest parsing, diff engine, applier, handler, CLI, provisioner builder, stack manager (uv run pytest tests/unit/ -v)
• Integration tests pass: idempotent apply, removal tracking, namespace auto-registration (uv run pytest tests/integration/test_provisioner.py -v)
• limits plan prints human-readable diff without modifying DynamoDB
• limits apply applies limits idempotently (second run produces zero changes)
• limits diff detects out-of-band drift between YAML and live state
• limits cfn-template generates valid CloudFormation template with Custom::ZaeLimiterLimits resource
• Removing a limit from YAML and running apply deletes it only if tracked in #PROVISIONER record
• Manually set limits (not in YAML) are preserved across applies

Closes #405

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.12%. Comparing base (b8800bb) to head (4a46c5d).
⚠️ Report is 23 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@             Coverage Diff             @@
##             main     #409       +/-   ##
===========================================
+ Coverage   53.58%   92.12%   +38.54%     
===========================================
  Files          33       35        +2     
  Lines        7383     7672      +289     
===========================================
+ Hits         3956     7068     +3112     
+ Misses       3427      604     -2823     

Flag	Coverage Δ
doctest	28.58% <5.53%> (-0.91%)	⬇️
e2e	42.17% <20.06%> (-1.53%)	⬇️
integration	51.10% <20.41%> (-1.18%)	⬇️
unit	91.87% <100.00%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.