Add application-wide production rate limiting

[Yuqing (mydmdm)]

Summary

• register one permissive application-wide @fastify/rate-limit policy before production routes, keyed only by the normalized direct TCP peer
• exempt CORS preflight and deployment readiness while covering browser, RFS, SSE connection attempts, static assets, and uploads before body parsing
• return canonical RATE_LIMITED errors and surface deduplicated localized UI warnings, with Canvas Sync honoring Retry-After
• document the deployment and trusted-proxy contract and add focused enforcement/client tests

Validation

• pnpm typecheck
• pnpm format
• pnpm lint:fix
• Server focused tests: 7 passed
• Web focused tests: 2 passed
• pnpm check:i18n
• git diff --check

CodeQL should rerun and verify production alerts #101, #102, #139, #140, and #141 are closed by the centrally registered recognized middleware.

Closes #177