[codex] Prune stale rate-limit buckets

[pq198363-ops]

Closes #142

Summary

• add deterministic rate-limit bucket helpers that prune stale IP buckets without real sleeping in tests
• opportunistically sweep expired buckets on each rate-limit hit so one-shot IP churn does not grow the map forever
• preserve active buckets and the existing 429 rate_limited response shape with Retry-After
• document the pruning behavior in the README

RED/GREEN

• RED: npm run build failed before implementation because src/ratelimit-prune.test.ts imported missing applyRateLimitHit and pruneExpiredRateBuckets helpers.
• GREEN: $env:NODE_ENV='test'; node --test dist/ratelimit-prune.test.js passed 4 pruning and active-limiter scenarios.

Verification

• npm run build
• $env:NODE_ENV='test'; node --test dist/ratelimit-prune.test.js -> 4 tests passed
• $env:NODE_ENV='test'; node --test dist/*.test.js dist/**/*.test.js -> 93 tests passed
• npm run lint
• npx prettier --check README.md src/middleware/index.ts src/ratelimit-prune.test.ts
• git diff --check

Note: the package npm test script uses Unix-style NODE_ENV=test; the Windows PowerShell equivalent above was used locally after clearing dist and rebuilding.