Harden Petabit DDoS handling

[ChevCellios]

Summary

• add a per-IP global rate limit for dynamic routes
• preserve the stricter ISS endpoint limit
• exempt liveness and readiness endpoints from rate limiting
• document the production behavior

Railway

• disabled temporary Under Attack Mode, which was returning 429 for all clients and monitors
• verified GET /, GET /health/live, GET /health/ready and HEAD health requests

Validation

• Release build: 0 warnings, 0 errors
• tests: 37 passed
• NuGet audit: no known vulnerable packages