rate-limiting: abuse logging + 429 Retry-After response shape

[disconsented]

Make rate-limit rejections observable and give the UI a clean signal to surface.

Scope

• Return 429 Too Many Requests with a Retry-After header from limited routes.
• Shape the rejection body as something the Svelte UI can detect and surface ("you're going too fast") rather than a raw 429 page.
• Emit a warn log including the issuer key (IP or user id) on every rejection, so repeat offenders are visible and limits can be tuned from real data.

Depends on

• rate-limiting: per-route limit buckets (search/item/write/login) #54 — per-route buckets

Parent: #50