Apply rate limiting / throttle to claim and conquest endpoints

Problem

A throttle middleware alias and rateLimitPerMinute config exist but aren't applied to the high-value POST /territories/claim and /process-conquest routes.

Acceptance

• Apply throttle to claim/conquest (and other write endpoints).
• Documented limits.

Done in 03f8e2d.

The existing Throttle middleware (per-authenticated-user keying with IP fallback; 429 + Retry-After + X-RateLimit-Limit/Remaining/Reset headers) is now applied to every write route in three tiers, documented in routes/api.ts next to the groups:

Rationale: one real run produces exactly one claim + one conquest call, so 30/min never touches a human but walls off scripted claim spam; sweeps are full-table recomputes already triggered by events.

Verified by scripts/verify-rate-limit.ts (12 checks): tier pattern parsing, enforcement at the limit (pass×3 → 429 with Retry-After), per-key isolation, and static assertions that the route tiers wrap exactly the documented paths inside the auth group.