feat(llm): add configurable request/token rate limiting for LLM client

Introduce process-local and Redis-backed global rate limiting for the
shared LLM client, plus a dedicated generation consumer prefetch knob.

- Add request (RPM) and token (TPM) rate limits with burst controls,
  process or global scope, and fail-closed/process-degraded failover
- Wire the LLM client through NewWithRedis so limits can be shared
  across replicas via a Redis token bucket
- Add generation_consumer_prefetch to tune RabbitMQ generation
  consumers independently of the default prefetch
- Bump generation worker_concurrency to 24 and promote golang.org/x/time
  to a direct dependency
- Drop t.Parallel() from a few middleware/bootstrap tests

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

server/internal/shared/middleware/security_headers_test.go

@@ -10,8 +10,6 @@ import (
 )
 
 func TestSecurityHeadersAddsNoStoreForSensitiveAuthPaths(t *testing.T) {
-	t.Parallel()
-
 	gin.SetMode(gin.TestMode)
 	router := gin.New()
 	router.Use(SecurityHeaders())
@@ -34,8 +32,6 @@ func TestSecurityHeadersAddsNoStoreForSensitiveAuthPaths(t *testing.T) {
 }
 
 func TestCORSWithConfigRejectsUnknownPreflightOrigin(t *testing.T) {
-	t.Parallel()
-
 	gin.SetMode(gin.TestMode)
 	router := gin.New()
 	router.Use(CORSWithConfig(CORSConfig{AllowedOrigins: []string{"https://admin.example.com"}}))
@@ -54,8 +50,6 @@ func TestCORSWithConfigRejectsUnknownPreflightOrigin(t *testing.T) {
 }
 
 func TestCORSWithConfigAllowsConfiguredOrigin(t *testing.T) {
-	t.Parallel()
-
 	gin.SetMode(gin.TestMode)
 	router := gin.New()
 	router.Use(CORSWithConfig(CORSConfig{AllowedOrigins: []string{"https://admin.example.com"}}))