refactor: extract shared rate limiter, standardize error codes, name constants

[CybotTM]

Summary

Code quality cleanup addressing issues found by comprehensive codebase audit:

• Extract SlidingWindowRateLimiter utility — consolidates 3 near-identical rate limiter implementations (ChallengeKeyRateLimiter, DeviceRegistrationRateLimiter, WebSocketConnectionRateLimiter) into a single reusable class with configurable maxRequests and windowMs. Reduces ~90 lines of duplicated synchronized sliding-window logic to a single 66-line utility.
• Add 8 unit tests for SlidingWindowRateLimiter — boundary conditions, key independence, reset, instance isolation, cleanup safety, concurrent access.
• Standardize ApiException error codes — replaces 10 instances of ApiException(HttpStatusCode.BadRequest.value, ...) with integer literals (400, 403, 404, 429) for consistency with 98 existing instances.
• Name magic numbers — extracts CLEANUP_INTERVAL_MS (5 min), MAX_REQUEST_BODY_BYTES (10 MB), and HSTS_MAX_AGE_SECONDS (2 years) from inline expressions in Application.kt.
• Update docs — test count 456→464, class count 40→41, add SlidingWindowRateLimiter to util listing and test table, fix stale comment references.
• Remove unused import — io.ktor.http.* from BucketService.kt.

Test plan

• All 464 server tests pass (456 original + 8 new)
• Detekt: zero violations
• Conformance tests: pass
• Android build: pass (881+ tests)
• CI: all 4 checks green on every commit
• No behavior changes — pure refactoring + docs
• 3 review cycles completed, all findings addressed