fix: reject throttler queue overflow

[realfishsam]

Summary

• Reject new throttle requests once the queue reaches its maximum depth instead of silently resolving the oldest waiter.

Tests

• npm test --workspace=pmxt-core -- --runInBand test/utils/throttler.test.ts

Fixes #690

[realfishsam]

PR Review: PASS (NOT VERIFIED)

What This Does

Makes throttler queue overflow reject callers immediately instead of leaving pending promises. Consumers benefit on any rate-limited path under queue pressure.

Blast Radius

Shared core throttler utility and tests; all exchange/server code using the throttler may be affected.
Changed files reviewed: core/src/utils/throttler.ts, core/test/utils/throttler.test.ts

Consumer Verification

Before (base branch):
Base branch (origin/main) does not include these changes. I reviewed the diff against the base and did not run full live-exchange before/after reproduction in this daily batch.

After (PR branch):
PR branch build PASS; authenticated local sidecar smoke PASS using POST /api/mock/fetchMarkets with x-pmxt-access-token, response snippet: {"success":true,"data":[{"marketId":"mock-m0","eventId":"mock-event-0","title":"Which party wins the 2026 harborland election?","description":"incididunt magna metus ut cupidatat aliquip dolore quis incididunt id do aenean aenean non dolor dolore tempor pharetra lorem fugiat aenean est voluptate ...

Test Results

• Build: PASS (npm run build --workspace=pmxt-core)
• Unit tests: PASS (npm test --workspace=pmxt-core -- --runInBand)
• Server starts: PASS
• E2E smoke: PASS (POST /api/mock/fetchMarkets; live venue-specific calls were not made)
• Dependency install: skipped (existing workspace deps reused)

Findings

No blocking findings.

PMXT Pipeline Check

• Field propagation (3-layer): N/A
• OpenAPI sync: N/A
• Financial precision: N/A
• Type safety: ISSUE
• Auth safety: N/A

Semver Impact

patch -- bug fix/internal compatibility change unless SDK consumers rely on newly added APIs

Risk

The branch was built, core-tested, and authenticated-smoke-tested through the sidecar. Full live-exchange before/after behavior remains unverified for this daily batch; credentialed venue calls and venue API drift should be treated as residual risk unless covered by tests in this PR.