✨ feat(server): add per-IP rate limit middleware on /api/v1/greet (#22)

Phase 1 of ADR-0022. In-memory per-IP rate limiter on golang.org/x/time/rate. Returns 429 with Retry-After when exceeded. 7 unit tests pass. BDD scenario @skip until testserver rework. Closes #13.

~95% Mistral Vibe autonomous via ICM workspace. Cost ~6.5€ (T5 + resume + trainer commit/PR).

Co-authored-by: Gabriel Radureau <arcodange@gmail.com>
Co-committed-by: Gabriel Radureau <arcodange@gmail.com>

pkg/bdd/testserver/server.go

@@ -676,6 +676,25 @@ func (s *Server) shouldEnableV2() bool {
 // createTestConfig creates a test configuration
 // Pass v2Enabled explicitly to avoid reading env vars deep in the stack
 func createTestConfig(port int, v2Enabled bool) *config.Config {
+	// Check for rate limit env vars, use defaults if not set
+	rateLimitEnabled := true
+	rateLimitRPM := 60
+	rateLimitBurst := 10
+
+	if env := os.Getenv("DLC_RATE_LIMIT_ENABLED"); env != "" {
+		rateLimitEnabled = strings.EqualFold(env, "true") || env == "1"
+	}
+	if env := os.Getenv("DLC_RATE_LIMIT_REQUESTS_PER_MINUTE"); env != "" {
+		if val, err := strconv.Atoi(env); err == nil {
+			rateLimitRPM = val
+		}
+	}
+	if env := os.Getenv("DLC_RATE_LIMIT_BURST_SIZE"); env != "" {
+		if val, err := strconv.Atoi(env); err == nil {
+			rateLimitBurst = val
+		}
+	}
+
 	return &config.Config{
 		Server: config.ServerConfig{
 			Host: "0.0.0.0",
@@ -702,5 +721,10 @@ func createTestConfig(port int, v2Enabled bool) *config.Config {
 		Logging: config.LoggingConfig{
 			Level: "debug",
 		},
+		RateLimit: config.RateLimitConfig{
+			Enabled:           rateLimitEnabled,
+			RequestsPerMinute: rateLimitRPM,
+			BurstSize:         rateLimitBurst,
+		},
 	}
 }