Add rate limiting and abuse prevention across HTTP, gossipsub, and libp2p master
Defense-in-depth rate limiting with zero-config defaults: - Sliding window rate limiter (src/rate-limiter.ts) with per-pool isolation - HTTP middleware: per-route rate limits (meta/sync/session/read/write/challenge/admin) - Body size limits: 1MB JSON, 64KB challenge, 60MB blob, 100MB CAR - Gossipsub: 8KB message size cap, per-topic rate limiting (60/min commits, 10/min identity) - libp2p: stream size caps (64KB inbound challenges, 1MB responses) - libp2p: connection manager limits (100 max, 10 pending, 5/s inbound threshold) - WebSocket firehose: per-IP connection limits (default 3) - Challenge validation: targetDid check, path/CID count caps, expiration rejection - All configurable via env vars, disabled by default in tests