[Security P0] Implement comprehensive rate limiting across all API endpoints (#132)

[om952]

Thinking Path

 > - Paperclip orchestrates AI agents for zero-human companies                                                                                                          
 > - The API server handles all agent and board operations via REST endpoints                                                                                           
 > - No rate limiting exists on any endpoint, enabling DDoS, brute-force, and resource exhaustion                                                                       
 > - Issue #132 (Security P0) requires comprehensive rate limiting across all API endpoints                                                                             
 > - This pull request implements tiered rate limiting with Redis + LRU fallback                                                                                        
 > - The benefit is protection against API abuse while maintaining availability via fail-open behavior                                                                  
                                                                                                                                                                        
What Changed                                                                                                                                                        
                                                                                                                                                                        
 - Added ioredis dependency for optional Redis-backed distributed rate limiting                                                                                         
 - Created server/src/middleware/rate-limiter.ts with 5-tier rate limiting:                                                                                             
   - Public: 60/min, Authenticated: 120/min, Heartbeat: 120/min, Write: 30/min, Admin: 300/min                                                                          
 - Implemented LRU fallback store (10k entries) when Redis is unavailable                                                                                               
 - Added config schema changes in packages/shared/src/config-schema.ts for redis and rateLimiting settings                                                              
 - Wired rate limiter into server/src/index.ts (Redis client creation) and server/src/app.ts (middleware mounting)                                                      
 - Health routes bypass rate limiting for load balancer health checks                                                                                                   
 - Added standard rate limit headers: X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, X-RateLimit-Tier                                                     
 - Implemented fail-open behavior (configurable via PAPERCLIP_RATE_LIMITING_FAIL_OPEN)                                                                                  
 - Path normalization for parameterized routes (UUIDs, numeric IDs → :id) to prevent per-endpoint gaming                                                                
 - Added 15 comprehensive unit tests in server/src/tests/rate-limiter.test.ts                                                                                           
                                                                                                                                                                        
 Verification                                                                                                                                                        
                                                                                                                                                                        
 bash                                                                                                                                                                   
 Start server                                                                                                                                                           
 cd /Users/omkandpal/Levi && pnpm dev                                                                                                                                   
 Check health endpoint (no rate limiting)                                                                                                                               
 curl -i http://localhost:3100/api/health                                                                                                                               
 Should return 200 without X-RateLimit-* headers                                                                                                                        
 Check rate limit headers on protected endpoint                                                                                                                         
 curl -i http://localhost:3100/api/companies                                                                                                                            
 Should show X-RateLimit-Limit: 60, X-RateLimit-Tier: public                                                                                                            
 Test rate limit blocking (exhaust 60 requests)                                                                                                                         
 for i in {1..65}; do                                                                                                                                                   
   curl -s -o /dev/null -w "%{http_code}\n" http://localhost:3100/api/companies                                                                                         
 done                                                                                                                                                                   
 First 60: 200, requests 61+: 429                                                                                                                                       
 Run unit tests                                                                                                                                                         
 pnpm test:run -- server/src/tests/rate-limiter.test.ts                                                                                                                 
 15 tests passing                                                                                                                                                       
 Typecheck                                                                                                                                                              
 pnpm --filter @paperclipai/server typecheck                                                                                                                            
 Passes                                                                                                                                                                 
                                                                                                                                                                        
 Risks                                                                                                                                                               
                                                                                                                                                                        
 - Low risk for local dev: LRU fallback works without Redis, no external dependency required                                                                            
 - Redis connection failure: Fail-open by default — if Redis goes down, requests are allowed (configurable to fail-closed)                                              
 - Memory usage: LRU store capped at 10k entries, oldest evicted when full                                                                                              
 - Path normalization edge cases: Some custom ID formats may not be normalized, could allow limited per-endpoint gaming                                                 
 - No migration needed: This is additive middleware, no database or schema changes required           

Closes #132