fix: fail closed on an unwritable audit log, bound the rate limiter and harden startup

The audit logger is opened at startup (exit 2 on failure) and obtained before
every call, which is refused with audit_unavailable otherwise. Audit records only
take validated path and sudo values and use the request id as correlation id. The
rate limiter evicts idle keys, caps tracked keys, audits the first excess per key
and window and uses the settings passed to the app. FORWARDED_ALLOW_IPS is now a
setting, and startup warns about a missing host allow-list and unavailable OAuth.

tests/conftest.py

@@ -14,7 +14,6 @@ import pytest
 
 from aegis_gitea_mcp.audit import reset_audit_logger
 from aegis_gitea_mcp.config import Settings, reset_settings
-from aegis_gitea_mcp.rate_limit import reset_rate_limiter
 from aegis_gitea_mcp.request_context import clear_gitea_auth_context
 
 
@@ -22,7 +21,6 @@ def _reset_singletons() -> None:
     """Reset every module-level singleton."""
     reset_settings()
     reset_audit_logger()
-    reset_rate_limiter()
     clear_gitea_auth_context()