#19515: security: add per-connection WebSocket rate limiting

## Summary - Add sliding window rate limiter for WebSocket connections (`ws-rate-limit.ts`) - Default limit: 100 messages per 10 seconds per connection - Warn client with JSON event before disconnecting on sustained abuse (3 warnings) - Integrate rate limiter into the WebSocket message handler - Configurable limits via `WsRateLimitConfig` ## Security Impact Prevents WebSocket flood attacks that could DoS the gateway server. Each connection is independently tracked. ## Test plan - [x] Unit tests for rate limiter logic (allow, block, sliding window, reset) - [x] Test warning count before disconnect - [x] Test default configuration (100 msg / 10s) - [x] Verify sliding window expiry <!-- greptile_comment --> <h3>Greptile Summary</h3> Added per-connection WebSocket rate limiting to prevent flood attacks. Each connection is independently tracked with a sliding window limiter (default: 100 messages per 10 seconds). The implementation includes: - New rate limiter module with configurable limits and automatic warning decay when traffic drops below 50% - Integration into WebSocket message handler that warns clients before disconnecting after 3 sustained violations - Comprehensive test coverage for core rate limiting logic The security improvement is sound and follows the existing patterns in the codebase (similar to `auth-rate-limit.ts`). The implementation correctly handles edge cases and uses an efficient sliding window algorithm. <h3>Confidence Score: 5/5</h3> - This PR is safe to merge with minimal risk - The implementation follows established patterns in the codebase, includes comprehensive test coverage, and addresses a real security concern. The sliding window algorithm is correctly implemented with proper bounds checking, and the integration into the message handler is clean and non-invasive. No breaking changes or risky modifications to existing code. - No files require special attention _{Last reviewed commit: bf4113a} <!-- greptile_other_comments_section --> _{(3/5) Reply to the agent's comments like "Can you suggest a fix for this @greptileai?" or ask follow-up questions!} <!-- /greptile_comment -->