fix: bound unauthenticated rate-limiter memory

[imran-siddique]

Summary

Bound the state retained by the unauthenticated /health and /readyz per-IP rate limiter. Expired client windows are reclaimed, and at most 10,000 active source addresses are tracked; new addresses fail closed with the existing 429 response when capacity is reached.

Root cause

The limiter pruned timestamps within each requesting IP's list but never removed IP keys from its process-lifetime dictionary. Source-address churn could therefore grow memory without bound even though each individual address stayed within its request budget.

Validation

• Added coverage for client-cardinality exhaustion
• Added coverage for expired-client reclamation
• Focused server tests: 25 passed
• Full clean-environment unit suite: 1052 passed, 8 skipped
• Ruff and mypy: clean
• Bandit: clean
• git diff --check: clean

Documentation

• Added the source-churn control and residual distributed-DoS risk to the threat model
• Added an Unreleased security changelog entry