[EmannuellaO]

Closes #1505

Summary

• Enforce per-key rate limiting in gateway limiter using key bucket with effective limit = min(rateLimitPerMinute, tier ceiling). Keys only narrow.
• Add store-backed per-key limiting via checkKeyLimit with safe tier resolution (hasOwnProperty/known tier set, reject prototype keys).
• Return effectiveRateLimitPerMinute in key creation/list responses and validate unknown tiers on create (400).
• Add truthful RateLimit headers on 429 reflecting the stricter bucket.
• Add tests for per-key limiting and tier hardening.

Headers: when both user and key buckets apply, headers advertise the bucket closer to exhaustion (stricter one). On 429, headers describe the bucket that caused the rejection.