v0.25.0 — rate limiter

A fixed-window rate limiter middleware:

this.use(rateLimiter({ max: 60, window: 60 }));                 // 60/min per IP
router.post("/login", handler).use(rateLimiter({ max: 5, window: 60 }));

Per-key buckets (client IP by default, or a custom key fn), standard X-RateLimit-* / Retry-After headers, and 429 on exceed. In-memory store by default; wrap your own for distributed limiting. See docs/rate-limiting.md.