feat(06-02): add fixed-window limiter, Store, and ClientIP

- MemoryStore mirrors Laravel tooManyAttempts-before-hit first-hit-wins
- FixedWindowLimiter + throttle factory; success and 429 rate-limit headers
- Trusted-proxy ClientIP; remove noOpLimit; keep Limiter interface seam

pact/capabilities.go

@@ -128,3 +128,5 @@ type OptionalMessage interface {
 // The kernel type-asserts HasConfig (party, before Register), HasCommands
 // (generated app main, after Boot), HasMigrations (lagoon migrate), and
 // HasMiddleware/HasMiddlewareFactories/HasRoutes (surf assemble).
+// surf.BucketProvider is type-asserted in Assemble (not a pact interface:
+// pact cannot import surf without a cycle).