fix(rate-limit): harden client IP resolution and drop localhost bypass

- getClientIp now trusts only a single configured header (client-ip-header,
  default CF-Connecting-IP) and otherwise falls back to the socket peer address.
  The previous CF/X-Forwarded-For/X-Real-IP fallback chain let a direct client
  spoof its IP and bypass the per-IP limiter.
- Remove the localhost exemption (a local reverse proxy made all traffic appear
  as 127.0.0.1, disabling rate limiting entirely).
- ConfigMigration5To6 surfaces the new client-ip-header option.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

feat: add global per-IP API rate limiting

Apply a token-bucket rate limiter as a global router handler to every request
under the router api-prefix, so abusive clients get HTTP 429 before any endpoint
logic runs.

- New `rate-limit` config section (enabled + named tiers). DEFAULT tier allows
  300 req/min (burst 300, refill 1 token / 200ms).
- Exceeding the limit returns 429 with Retry-After and X-RateLimit-* headers and
  an {"result":"error","error":"RATE_LIMIT_EXCEEDED","retryAfter":N} body.
- Plugins can register custom tiers / path matchers via RateLimitManager.
- ConfigMigration4To5 adds the section to existing configs.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

fix: fixed plugin config migration not finishing migration

fix: fixed plugin lifecycle

fix: fixed plugins not starting correctly

fix: should fix preflight requests - attempt 2

fix: should fix preflight requests

feat: added allowed hosts, schemes, headers config

feat: improved codebase

refactor: refactored build.gradle.kts