feat(mcp): per-credential rate limiting for the MCP tool-call surface

[Makisuo]

What

Adds rate limiting to the authenticated MCP surface (POST /mcp), which had none while the MCP OAuth handshake already did — leaving the endpoint whose tool calls run warehouse queries and LLM calls as the most expensive unlimited path in the API.

• New McpToolRateLimiter built on makeRateLimitCheck, extracted from ApiV2RateLimiter: the same generic check(key) with fail-open semantics — allowed / limited / failed_open, always with maple.rate_limit.outcome telemetry, never a silent pass (deliberately not the bare-return fail-open in McpOAuthService).
• Dedicated MCP_TOOLS_RATE_LIMITER binding, 120 req / 60 s (namespace 2026082901), declared in alchemy.run.ts and mirrored in wrangler.jsonc. A new binding rather than reuse because a limit is fixed per binding, and neither the v2 API's 600/60s nor the handshake's 60/60s fits this surface's cost profile.
• Keyed per credential, never IP: key:<internal keyId> for OAuth tokens and manual MCP keys — rolling a key starts a fresh budget and the raw secret never reaches the counter — and user:<userId> for dashboard-session auth. The internal service token is exempt: it is one shared token, so a per-credential bucket would throttle every internal caller together.
• 429 with Retry-After: 60 on limited, using V2RateLimited's wording in the MCP surface's existing { error, message } envelope (the /mcp route is not inside the v2 HttpApi serializer). The span records outcome, limit, and period; enforcement runs in the authorization middleware right after credential resolution, matching the v2 layer's order.
• Docs: new "Rate limiting" section in docs/mcp-oauth.md. docs/api-v2.md untouched — it documents only the /v2 surface.

Reviewer notes

• ApiV2RateLimiterApi → RateLimiterApi rename: the interface stopped being v2-specific; only one type-import needed updating.
• The credential identity travels as rateLimitCredentialId on the resolved MCP tenant (McpAuthenticatedTenant extends TenantContext structurally, so the chat-sessions caller of the same resolver is unaffected and unlimited).
• Tests: new McpToolRateLimiter.test.ts (own binding + stage partition, fails open when only the v2 binding is present) and a new app.test.ts case asserting 429 / Retry-After / key:<id> bucket with the executor never invoked.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}