6. Rate limit + quota headers

Sent on every response (not just 429):

X-RateLimit-Limit: 60
X-RateLimit-Remaining: 47
X-RateLimit-Reset: 1747923600

X-Quota-Limit: 5000
X-Quota-Remaining: 4823
X-Quota-Reset: 1747958400

• X-RateLimit-*: per-minute window (60/min default per key)
• X-Quota-*: per-day workspace quota (5,000/day default, admin override)
• *-Reset: unix epoch seconds
• WebSocket events don't count against quota; HTTP requests = 1 quota unit each (regardless of ?limit=)

---