v1.3.1

Inverts the throttle/ratelimit chain so RateLimit wraps Throttle.
Pre-1.4 ordering let throttle keep admitting new requests during a
gofri secondary cooldown; at cooldown end the parked requests
stampeded the server simultaneously, re-tripping the abuse detector.
Inverted ordering parks new arrivals inside gofri's waitForRateLimit
before they consume throttle tokens, so post-cooldown release is
bounded by the throttle burst.

Changed

• Transport stack: ratelimit now wraps throttle instead of the
  inverse. Callers using only one of the two layers see no behavior
  change. Logger event ordering is inverted as a side effect: throttle
  events now emit inside ratelimit's RoundTrip span rather than
  wrapping it; observability dashboards keying on the legacy ordering
  need adjustment.