API keys: enforce per-key rate limiting (currently a stub)

Problem: rate-limit structure exists but isn't enforced (audit).

Scope: enforce per-key request/event rate limits on ingest + read; return 429 with headers.

Done when: a key exceeding its limit is throttled.