Per-user and per-org rate limiting

Token-bucket rate limiting on write endpoints, backed by Redis, scoped both per user and per org, returning 429 with a Retry-After header.

Two scopes because they stop different attacks - per-user stops one bad client, per-org stops one bad tenant starving the others. Retry-After is what separates a rate limit clients can cooperate with from one they hammer.