P1: Add per-client quotas and budget guardrails

[Neftedollar]

Parent epic: #236

Problem

Global limits are insufficient for multi-tenant clients and abuse control.

Scope

• Add per-client rate and concurrency limits.
• Add per-client budget/usage ceilings over configurable windows.
• Emit quota headers/metadata in status responses where applicable.

Acceptance Criteria

• Quotas are enforceable per identity key.
• Violations return deterministic throttle/limit errors.
• Metrics expose quota utilization for operations.

Non-goals

• Billing system integration.