[Security P0] Implement comprehensive rate limiting across all API endpoints

[AnilChinchawaleXDC]

Source: ARCHITECTURE-REVIEW.md, SECURITY_AUDIT.md, PROD-READINESS-REVIEW.md, SECURITY-REPORT.md, PR_RATE_LIMITING.md

Problem: No rate limiting on any endpoint enables DDoS, brute-force, and resource exhaustion.

Actions:

1. Implement tiered rate limiting (Public: 60/min, Authenticated: 120/min, Heartbeat: 120/min, Write: 30/min, Admin: 300/min)
2. Use Redis-based distributed rate limiting with LRU fallback
3. Add standard rate limit headers (X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset)
4. Ensure fail-open behavior if Redis is unavailable

Risk: DDoS, API abuse, resource exhaustion.

---

Mirrored from Paperclip OPEA-346 (https://agi.openscan.ai/OPEA/issues/OPEA-346)