fix: don't preflight-block unmetered (demo) rate-limit snapshots

Demo/unauthenticated responses carry x-api-ratelimit-limit=0,
remaining=0 with a future reset on every successful (203) call — the
API's "unmetered" signal, not an exhausted quota. The §10.3 preflight
gate read that remaining=0 as exhaustion and short-circuited every
request after the first demo response, breaking demo mode for the AAPL
options/stocks/funds data the API serves without a token.

Treat limit==0 as unmetered and allow the request; a genuine
exhaustion is limit>0 && remaining==0 (still blocked). Adds a covering
unit test (preflightAllowsWhenSnapshotIsUnmeteredDemo).

Author: MarketDataDev01

src/main/java/com/marketdata/sdk/HttpTransport.java

@@ -210,8 +210,15 @@ private static boolean isServerHintedRetry(@Nullable Throwable previousCause) {
   /**
    * Returns a {@link RateLimitError} when the last-known snapshot reports zero remaining credits
    * <em>and</em> the snapshot's {@code reset} timestamp is still in the future. Returns {@code
-   * null} when the request is allowed (credits available, no snapshot yet, or the reset window has
-   * elapsed — the snapshot is stale and the next response's headers will refresh it).
+   * null} when the request is allowed (credits available, an unmetered demo snapshot, no snapshot
+   * yet, or the reset window has elapsed — the snapshot is stale and the next response's headers
+   * will refresh it).
+   *
+   * <p>The {@code limit == 0} guard is what keeps demo mode working: unauthenticated/demo responses
+   * carry {@code limit=0, remaining=0} on every successful (HTTP 203) call — the API's "unmetered"
+   * signal, not an exhausted quota. Treating that {@code remaining=0} as exhaustion would block
+   * every request after the first demo response (e.g. AAPL options/stocks/funds the API serves
+   * freely without a token). A genuine exhaustion is {@code limit > 0 && remaining == 0}.
    *
    * <p>Without the reset check, a single response carrying {@code remaining=0} would freeze the
    * client forever: the preflight would short-circuit every subsequent request, no request would
@@ -220,7 +227,7 @@ private static boolean isServerHintedRetry(@Nullable Throwable previousCause) {
    */
   private @Nullable RateLimitError checkRateLimitPreflight(URI uri) {
     RateLimitSnapshot snap = latestRateLimits.get();
-    if (snap == null || snap.remaining() > 0) {
+    if (snap == null || snap.limit() == 0 || snap.remaining() > 0) {
       return null;
     }
     Instant now = clock.instant();

src/test/java/com/marketdata/sdk/HttpTransportTest.java

@@ -483,6 +483,33 @@ void preflightAllowsWhenSnapshotShowsCreditsRemaining() {
     assertThat(client.captured).hasSize(2);
   }
 
+  /**
+   * Demo / unauthenticated responses carry {@code limit=0, remaining=0} on every successful (203)
+   * call — the API's "unmetered" signal, NOT an exhausted quota. The preflight must let every
+   * subsequent request through; otherwise demo mode breaks after the first call (the SDK would
+   * block AAPL options/stocks/funds that the API serves freely without a token).
+   */
+  @Test
+  void preflightAllowsWhenSnapshotIsUnmeteredDemo() {
+    long resetEpoch = Instant.now().plus(Duration.ofHours(1)).getEpochSecond();
+    HttpHeaders demo =
+        TestHttpClients.headersOf(
+            Map.of(
+                "x-api-ratelimit-limit", "0",
+                "x-api-ratelimit-remaining", "0",
+                "x-api-ratelimit-reset", String.valueOf(resetEpoch),
+                "x-api-ratelimit-consumed", "0"));
+    CapturingClient client = new CapturingClient(203, "ok".getBytes(), demo);
+    HttpTransport transport = newTransport(client);
+
+    // First call lands the unmetered snapshot (limit=0, remaining=0, reset in the future).
+    transport.executeAsync(RequestSpec.get("options/chain/AAPL").build()).join();
+    // Second call must still reach the wire — limit=0 means unmetered, not exhausted.
+    transport.executeAsync(RequestSpec.get("options/chain/AAPL").build()).join();
+
+    assertThat(client.captured).hasSize(2);
+  }
+
   /**
    * Before any rate-limit-bearing response has arrived, the snapshot is {@code null} — the first
    * request must NOT be blocked despite there being "zero" remaining in the EMPTY sentinel. The