Add rate limiting middleware (#1916)

[bpamiri]

Summary

• Adds wheels.middleware.RateLimiter with three strategies: fixed window, sliding window, and token bucket
• Supports in-memory (ConcurrentHashMap) and database-backed storage
• Configurable key functions, header prefixes, proxy trust, and per-route scoping
• Sets standard X-RateLimit-* headers and returns 429 Too Many Requests with Retry-After

Files

File	Action
vendor/wheels/middleware/RateLimiter.cfc	Created — core implementation (551 lines)
tests/specs/middleware/RateLimiterSpec.cfc	Created — 22 TestBox BDD specs
docs/src/handling-requests-with-controllers/rate-limiting.md	Created — framework docs
.ai/wheels/middleware/rate-limiting.md	Created — AI reference
docs/src/SUMMARY.md	Edited — added nav entry
CHANGELOG.md	Edited — added unreleased entry
CLAUDE.md	Edited — updated middleware quick reference

Design Decisions

• Fail-open: Lock timeouts allow the request through rather than blocking — prevents the rate limiter from becoming a bottleneck under extreme load
• Per-key locking: cflock names include the client key, so different clients never contend with each other
• ConcurrentHashMap: Thread-safe reads without locking; cflock only needed for compound read-modify-write
• Throttled cleanup: Memory cleanup runs at most once per minute to avoid overhead
• DB auto-create: $ensureTable() creates wheels_rate_limits on first use — no migration needed

Test plan

• Unit tests cover all three strategies (fixed window, sliding window, token bucket)
• Tests verify init validation, rate blocking, client isolation, pipeline integration
• Tests use Pipeline.run() — same approach as MiddlewarePipelineSpec.cfc
• Run full test suite on CI

Closes #1916

🤖 Generated with Claude Code