v0.1.0 — Rate limiting

Initial release. Token bucket + sliding window, in-memory + Redis Lua backends, IP/user/API-key identities, decorator + middleware. Security review applied before ship — see CHANGELOG.