Rate limits

Per-IP shield (~60/min) plus per-key limiter. Exceeding returns 429 with Retry-After: 60 and code rate_limited. Back off exponentially.